Trezor Says 347,000 Users Received Phishing Emails After Brevo Hack
A hack of marketing platform Brevo has resulted in phishing emails targeting approximately 347,000 Trezor customers. The attacker exploited SSO to gain access to Brevo accounts and then used those accounts to send phishing messages, potentially leading to wallet compromise. This follows a previous data breach involving ShipMonk and highlights a growing trend of attacks targeting cryptocurrency users.
Cold cryptocurrency storage provider Trezor says roughly 347,000 of its customers received phishing emails after a third-party marketing platform used by the company, Brevo, was hacked. The incident involved Brevo’s handling of SAML Single Sign-On (SSO), where an attacker exploited the system to access 138 accounts.
“The attacker created a Brevo account and enabled single sign-on (SSO) on it, then invited legitimate Brevo users into that SSO configuration,” Brevo explained. “Using their own identity provider, they were able to sign in as those invited users, which by itself is expected behavior for SSO.”
“This access was not properly scoped: instead of being limited to the single organization where SSO was enabled, it wrongly granted the attacker access to all organizations those users could reach,” it added. According to the company, the attacker sent phishing messages to the email addresses stored under six of the compromised accounts, and exfiltrated contacts from 43 accounts.
One of the customers whose email list was abused for a phishing campaign appears to be Trezor, which informed customers on Thursday that the attacker sent phishing emails to 347,000 email addresses stored in the Brevo account. The phishing emails had the subject line “Critical Security Alert: STM32 Entropy Vulnerability” and contained a link pointing to a malicious website. Trezor warned customers that their funds could be lost if they clicked on the link and entered their wallet backup.
Only 2,500 users clicked on the link before the malicious website was taken offline 20 minutes after the incident was detected. It’s unclear how many users may have lost funds and how much. Swiss Bitcoin hardware wallet maker BitBox and crypto tax calculator CoinTracking also appear to have been hit by the Brevo hack, but they haven’t shared details on the impact and have not named Brevo as the source of the incident.
The incident comes less than a month after Trezor admitted that the personal information of nearly 14,000 people was compromised in a data breach affecting its third-party shipping provider ShipMonk. An update Trezor shared on September 4 revealed that the ShipMonk leak affects an additional 67,000 US customers, including their name, email, shipping address, phone number, and order number.
Both incidents could lead to a surge in phishing attacks targeting Trezor customers.