Attackers broke into Brevo, the email platform Trezor uses for newsletters, and sent a phishing “security warning” from Trezor’s real mailing system. The email claimed a serious hardware issue could expose wallet recovery seeds and pushed people to a malicious site/app that asked for a wallet backup. The campaign reached 347,000 subscribers, and about 2,500 clicked before Trezor shut it down.
Attackers gained access to Brevo, the third-party email platform Trezor uses to send its newsletters. Using that access, they sent a phishing email directly through Trezor's legitimate mailing system, meaning the message technically came from a real, trusted sending channel. The email warned recipients of a serious 'STM32 Entropy Bug' that could allegedly expose wallet recovery seeds, then directed them to a malicious website and application that asked for their wallet backup. The campaign reached 347,000 subscribers, and roughly 2,500 people clicked the malicious link before Trezor disabled the compromised Brevo account within about 20 minutes and worked to take the malicious domain down at the DNS level.
The core reason this lure worked is that it arrived through a channel recipients already trusted: Trezor's own newsletter system. Most phishing awareness training focuses on spotting spoofed senders or suspicious domains, but this email didn't need to spoof anything, it was sent from the real infrastructure. Combined with a fear-based pretext about a hardware vulnerability threatening users' funds, the message created urgency that pushed people to act before verifying the claim through other means.
Organizations and individuals should treat messages from trusted brands as one signal of legitimacy, not proof that the instructions inside are safe. Recovery phrases, passwords, and other authentication secrets should be treated as information that is never shared in response to an unsolicited request, regardless of how official the message looks. Because this incident shows how breaching a trusted vendor can give attackers a direct route to a company's audience, IT and security teams managing SaaS or vendor access should plan for the possibility that a legitimate communication platform could be misused to reach users directly. Anyone who did submit a wallet backup on the malicious site should assume compromise and move funds to a new wallet with a new recovery seed immediately.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Attackers compromised Trezor's account at Brevo, the third-party email platform Trezor uses for newsletters, and used that access to send a fake security alert directly through Trezor's legitimate mailing system.
It claimed Trezor devices were affected by a serious 'STM32 Entropy Bug' that could expose users' wallet seeds, creating urgency for recipients to act quickly.
Trezor advises anyone who entered a wallet backup on the malicious site to immediately create a new wallet with a new recovery seed and transfer their funds to it.
The campaign reached 347,000 subscribers, and about 2,500 clicked the malicious link before Trezor shut it down.
Imagine this: a scary security alert from Trezor, sent through Trezor’s real newsletter system… and it’s the phish. Attackers broke into Brevo, Trezor’s email vendor, and blasted 347,000 users a fake ‘STM32 Entropy Bug’ warning, pushing them to a site and app that calmly asked for one thing: your wallet backup, your recovery seed. Here’s the catch: Trezor said their devices and wallets weren’t hacked, and just clicking that link didn’t steal funds. The only way this works is if you actually type your recovery seed into that website or app. So if any email ever asks for a wallet backup or recovery phrase, no matter how legit it looks, do one thing: stop, close it, and go straight to the official app or website to check there instead.
Trezor reported that about 347,000 customers received phishing emails after attackers abused a breach at its third‑party email marketing provider, Brevo. The phishing message used a “Critical Security Alert” theme and linked to a malicious site that attempted to trick users into entering their…
Microsoft warns of an active social engineering campaign where attackers pose as an IT help desk and pressure employees to “update” passkeys/MFA/SSO. Victims are sent to fake Microsoft sign-in pages or tricked into approving access via device-code login, enabling attackers to add their own MFA…
Attackers abused access to Brevo (an email marketing platform) to send highly convincing phishing emails from legitimate cryptocurrency company domains to newsletter subscribers. The lures claimed urgent security issues (hardware vulnerability or data breach) and pushed victims to click links,…
Attackers abused access to a third-party email newsletter provider to send convincing “security alert” emails from legitimate-looking crypto company domains. The emails pushed users to click links that led to phishing sites designed to look nearly identical to real platforms. Trezor, CoinTracking,…
Trezor said attackers breached its third-party email provider (Brevo) and gained access to Trezor’s email domain, triggering phishing emails to subscribers. The scam emails used a fake “critical security alert” about a supposed microcontroller vulnerability and attempted to trick users into handing…
The bulletin describes real-world social engineering where staff were tricked into disclosing sensitive data or access. In one case, Revolut employees responded to fraudulent information requests sent from a real government-domain email account, exposing extensive customer records. Separately,…
