Brevo flaw exposed Trezor subscribers to phishing

A flaw in Brevo’s login system allowed an attacker to access multiple client accounts and send phishing emails to large mailing lists, including roughly 347,000 Trezor subscribers. The incident also affected BitBox and CoinTracking, whose accounts were used to distribute fraudulent messages that appeared legitimate. Brevo said the attacker created an account, enabled single signon, and invited legitimate users into the setup, but an authorization failure gave access beyond the intended organization. The company said six accounts were used to send phishing emails, while contacts were exported from dozens of accounts. Trezor said the phishing message linked to a site that asked users for wallet backups, and it disabled the domain quickly after the campaign began. The company said it is treating the newsletter addresses as potentially exposed and warned subscribers to remain cautious. BitBox and CoinTracking said their accounts held limited data and were used to send unauthorized emails while they waited for more information from Brevo.