Attackers abused access to Brevo (an email marketing platform) to send highly convincing phishing emails from legitimate cryptocurrency company domains to newsletter subscribers. The lures claimed urgent security issues (hardware vulnerability or data breach) and pushed victims to click links, download an app, and provide sensitive wallet/API information.
Attackers gained access to Brevo, an email marketing platform used by several cryptocurrency companies and other firms, by exploiting its SAML SSO handling. This gave them access to 138 customer accounts. Six of those accounts were used to send phishing emails, and contacts were exported from 43 accounts. Because the emails went out through the legitimate domains of trusted companies like Trezor and CoinTracking, they bypassed the usual skepticism that unfamiliar senders would trigger.
Trezor subscribers received an email with the subject "Critical Security Alert: STM32 Entropy Bug Identified" and a subtitle warning of an urgent hardware microcontroller vulnerability. The message pushed recipients to click a link, download an app, and enter their wallet backup or recovery information, an extremely sensitive piece of data that gives full control over a crypto wallet.
CoinTracking customers received a different lure, a "Data Breach Notice" urging them to refresh their API keys as soon as possible, again through a malicious link. Both messages relied on urgency and a plausible security-related premise to get victims moving quickly instead of pausing to verify.
This was a supply-chain phishing campaign carried out through a third-party vendor rather than a direct compromise of Trezor or CoinTracking themselves. Because the emails came from real company domains and mimicked routine security notifications, recipients had little reason for immediate suspicion. It can be difficult to recognize a phishing email when it comes from a legitimate company domain and looks convincing, which is exactly the gap this campaign exploited.
Organizations and individuals handling crypto assets should verify urgent security alerts through the company's official website or app rather than trusting a link in an email. Apps should never be installed from links in unsolicited messages, no matter how urgent the claim. Recovery phrases should never be entered anywhere other than on the physical hardware device, and reputable companies will not ask for recovery phrases, API keys, or login details by email. Since this incident shows that trusted domains can still deliver phishing when a vendor is compromised, treating a familiar sender as sufficient proof of legitimacy is no longer a safe assumption.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Attackers exploited Brevo's SAML SSO handling to access 138 customer accounts, using 6 of them to send phishing emails and exporting contacts from 43 accounts.
The phishing emails were delivered through legitimate company domains, which made them look convincing since it can be difficult to recognize phishing when it comes from a domain you already trust.
It urged recipients to click a link, download an app, and enter their wallet backup or recovery phrase, framed as an urgent fix for a supposed hardware microcontroller vulnerability.
Verify the claim through the company's official website or app rather than clicking the link in the email, and never enter a recovery phrase anywhere other than on the physical device.
You get an email from Trezor or CoinTracking, sent from their real domain, screaming: “Critical Security Alert” or “Data Breach Notice.” Attackers abused Brevo’s SAML SSO to get into 138 marketing accounts, then used six real crypto company senders to blast phishing to newsletter subscribers like you. The Trezor email pushes a link to download an app and enter your wallet backup. The CoinTracking one urges you to click and “refresh API Keys.” Both are after your recovery phrase or API keys. Here’s the rule: if an email claims an urgent crypto security issue, don’t click anything, open the official site or app yourself and check for alerts there.
Trezor reported that about 347,000 customers received phishing emails after attackers abused a breach at its third‑party email marketing provider, Brevo. The phishing message used a “Critical Security Alert” theme and linked to a malicious site that attempted to trick users into entering their…
Attackers abused access to a third-party email newsletter provider to send convincing “security alert” emails from legitimate-looking crypto company domains. The emails pushed users to click links that led to phishing sites designed to look nearly identical to real platforms. Trezor, CoinTracking,…
Trezor said attackers breached its third-party email provider (Brevo) and gained access to Trezor’s email domain, triggering phishing emails to subscribers. The scam emails used a fake “critical security alert” about a supposed microcontroller vulnerability and attempted to trick users into handing…
Attackers broke into Brevo, the email platform Trezor uses for newsletters, and sent a phishing “security warning” from Trezor’s real mailing system. The email claimed a serious hardware issue could expose wallet recovery seeds and pushed people to a malicious site/app that asked for a wallet…
Researchers found dozens of lookalike websites impersonating real crypto projects and promising a small, believable reward boost if users “vote” on a rewards distribution date. The vote is fake; clicking “Vote now” triggers a wallet connection prompt and can lead to malicious approval/signature…
This bulletin describes multiple real-world scams where attackers make fake pages and messages look like routine, trusted experiences (search answers, Google login pop-ups, “giveaways,” and official-sounding calls). Examples include a fake Claude Max giveaway using a convincing fake Google sign-in…
