Trezor: 347,000 users targeted in phishing attacks after Brevo breach
Trezor reported phishing after the Brevo breach targeted 347,000 newsletter subscribers, with 2,500 users clicking before the domain was taken down.
Threat actors who breached Trezor's third-party email provider Brevo on September 9, 2026 sent fake 'critical security alert' emails from help@trezor.io to 347,000 opted-in newsletter subscribers, claiming an STM32 microcontroller vulnerability exposed wallet seeds. The emails linked to a malicious app that asked users to enter their wallet backup; 2,500 users clicked before Trezor disabled the phishing domain within 20 minutes. Trezor also disclosed that a prior breach via logistics provider ShipMonk, exploited through a critical Metabase SQL injection zero-day, affected 81,000 customers and drew extortion emails from the ShinyHunters gang.
- Brevo incident on September 9, 2026 affected 120 Brevo accounts
- 347,000 Trezor newsletter addresses targeted; 2,500 clicked the phishing link
- Fake emails claimed a hardware microcontroller vulnerability in STM32-based wallets
- Phishing domain taken down within 20 minutes; Brevo account suspended
- Prior ShipMonk breach via Metabase SQL injection zero-day affected 81,000 customers; ShinyHunters sent extortion emails
- Threat actors
- ShinyHunters
- Victims
- Trezor customers
From the original article
2 min read at bleepingcomputer.com
Trezor has revealed that phishing attacks against its customers earlier this week targeted 347,000 email addresses and affected 2,500 users who clicked an embedded malicious link. [...]
By Sergiu Gatlan · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.