Brevo confirmed that six compromised accounts were used to distribute phishing emails, while contacts were exported from 43 accounts. The platform reported that an authorization boundary failure allowed attackers to access multiple organizations after inviting legitimate users into a configuration via single sign-on.
The phishing campaign targeted 347 000 Trezor subscribers with a message regarding a fake security vulnerability. Trezor disabled the malicious domain within 20 minutes, though approximately 2 500 users accessed the link before the takedown. The attackers requested wallet backups from victims.
BitBox reported that its Brevo account contained only email addresses and language preferences. The company found no evidence of compromised credentials or lost funds but is investigating the incident. CoinTracking also reported that its account was used to send fraudulent emails regarding API keys.
The security incident led to warnings from Trezor and BitBox, which identified Brevo as their shared email service provider. The phishing messages successfully bypassed standard authentication checks, appearing as genuine communications from the companies.
