Trezor Says 347,000 Users Received Phishing Emails After Brevo Hack
Attackers abused Brevo's SAML SSO to access 138 accounts, sending phishing emails to 347,000 Trezor customers and exfiltrating contacts from 43 accounts.
Trezor said 347,000 of its customers received phishing emails with the subject line 'Critical Security Alert: STM32 Entropy Vulnerability' after the attacker compromised the Brevo marketing platform. Brevo said the intruder created an account, enabled SAML SSO, and used its own identity provider to access 138 accounts, exfiltrating contacts from 43 of them. Trezor reported 2,500 users clicked the malicious link before the site was taken offline 20 minutes after detection; potential fund losses are unknown. Swiss wallet maker BitBox and crypto tax calculator CoinTracking also appear affected, and Trezor separately disclosed a ShipMonk breach now affecting roughly 81,000 people.
- Brevo attacker abused SAML SSO scoping to access 138 accounts and exfiltrate contacts from 43.
- Phishing emails spoofed an 'STM32 Entropy Vulnerability' alert, luring users to enter wallet backups.
- Only 2,500 users clicked before the malicious site went offline 20 minutes after detection.
- BitBox and CoinTracking also appear affected; Trezor separately disclosed a ShipMonk breach affecting ~81,000.
Full article431 words · extracted from securityweek.com · click to collapse
Cold cryptocurrency storage provider Trezor says roughly 347,000 of its customers received phishing emails after a third-party marketing platform used by the company was hacked.
The incident involved the marketing platform Brevo, which Trezor uses for newsletters. Brevo said an attacker exploited how it handles SAML Single Sign-On (SSO) to access 138 accounts.
“The attacker created a Brevo account and enabled single sign-on (SSO) on it, then invited legitimate Brevo users into that SSO configuration. Using their own identity provider, they were able to sign in as those invited users, which by itself is expected behavior for SSO,” Brevo explained.
“This access was not properly scoped: instead of being limited to the single organization where SSO was enabled, it wrongly granted the attacker access to all organizations those users could reach,” it added.
According to the company, the attacker sent phishing messages to the email addresses stored under six of the compromised accounts. In addition, the threat actor exfiltrated contacts from 43 accounts.
One of the customers whose email list was abused for a phishing campaign appears to be Trezor, which informed customers on Thursday that the attacker sent phishing messages to 347,000 email addresses stored in the Brevo account.
Advertisement. Scroll to continue reading.
The phishing emails had the subject line “Critical Security Alert: STM32 Entropy Vulnerability” and contained a link pointing to a malicious website.
Trezor has not shared details about the malicious site, but warned customers that their funds could be lost if they clicked on the link and entered their wallet backup.
According to Trezor, only 2,500 users clicked on the link before the malicious website was taken offline 20 minutes after the incident was detected. It’s unclear how many users may have lost funds and how much.
Swiss Bitcoin hardware wallet maker BitBox and crypto tax calculator CoinTracking also appear to have been hit by the Brevo hack, but they haven’t shared details on the impact and have not named Brevo as the source of the incident.
The incident comes less than a month after Trezor admitted that the personal information of nearly 14,000 people was compromised in a data breach affecting its third-party shipping provider ShipMonk.
An update Trezor shared on September 4 revealed that the ShipMonk leak affects an additional 67,000 US customers, including their name, email, shipping address, phone number, and order number.
Both incidents could lead to a surge in phishing attacks targeting Trezor customers.
Related: Surfshark Systems Targeted by Hackers
Related: 4.1 Million Impacted by AdaptHealth Data Breach
Related: Mathspace Data Breach Exposes Over 1 Million People
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.securityweek.com/trezor-says-347000-users-received-phishing-emails-after-brevo-hack/