# Trezor, BitBox, and CoinTracking Subscribers Targeted by Phishing After Brevo SAML SSO Authorization-Boundary Breach

> An attacker abused a SAML SSO authorization-boundary flaw in the Brevo (formerly Sendinblue) email-marketing platform to reach 138 client accounts, exfiltrate contact lists from 43, and use 6 to send brand-impersonating phishing emails to roughly 347,000 Trezor newsletter subscribers plus BitBox and CoinTracking customers. The Trezor lure, titled "Critical Security Alert: STM32 Entropy Vulnerability," drove about 2,500 clicks to a fake wallet-recovery-seed-harvesting tool before Trezor pulled the domain at DNS level within 20 minutes.

- **Published:** 2026-09-11T00:00:00Z
- **Last reviewed:** 2026-09-11T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2445
- **ID:** TL-2026-2445
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 8 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-09-09, Brevo — the third-party email/newsletter SaaS platform (formerly Sendinblue) used by hardware-wallet maker Trezor, Swiss hardware-wallet maker BitBox (Shift Crypto), and crypto tax tool CoinTracking — suffered a security incident rooted in its SAML single sign-on implementation. According to Brevo's postmortem, the attacker created their own Brevo account, enabled SSO, and invited legitimate Brevo customer-org users into that attacker-controlled SSO configuration. Access was intended to stay scoped to the attacker's own organization, but an authorization-boundary defect instead extended it to every organization the invited users could themselves reach. Brevo's investigation found 138 client accounts were touched, contact lists were exported from 43 of them, and 6 accounts were actually used to send phishing mail (93 accounts showed no meaningful attacker activity; Brevo did not clarify whether these categories overlap).

Using that access, the attacker sent phishing email from Trezor's legitimate Brevo-relayed sending identity (help@trezor.io), which meant the messages passed SPF/DKIM/DMARC checks. The Trezor lure — subject "Critical Security Alert: STM32 Entropy Vulnerability" — falsely claimed a hardware flaw in the STM32 microcontrollers used in Trezor devices could allow brute-forcing of wallet entropy/recovery seeds, and directed roughly 347,000 opt-in newsletter subscribers to a fake "Entropy Check" verification tool hosted on a newly registered look-alike domain designed to harvest 12/24-word wallet recovery seed phrases. Trezor detected the campaign and disabled the malicious domain at the DNS level within 20 minutes, but approximately 2,500 recipients had already clicked through. Trezor suspended its Brevo account, disabled the platform's email-sending function for its tenant, and posted public warnings across trezor.io, Trezor Suite, and support channels advising anyone who had entered a recovery seed to treat the funds as compromised and move them to a newly generated wallet immediately. Trezor stated it could not confirm whether the newsletter list itself had been exported, and that no other Trezor systems (beyond the newsletter database) were touched.

BitBox's compromised Brevo tenant held only email addresses and language preferences and was used to blast the full newsletter and tutorial distribution list with the same style of brand-impersonating alert; BitBox reported no evidence of compromised credentials or stolen funds. CoinTracking's subscribers received a differently worded lure, "Data Breach Notice: Please refresh API Keys as soon as possible," sent through the same compromised Brevo infrastructure. Brevo stated the unauthorized access was fully closed at 11:30 AM CEST on 2026-09-10. No malware family, C2 infrastructure, or specific phishing domain/IP has been publicly disclosed by Trezor, BitBox, CoinTracking, or Brevo as of publication; no CVE was assigned because the flaw is an application-level SaaS authorization-boundary/business-logic defect rather than a versioned software vulnerability, and the "STM32 entropy vulnerability" itself is fabricated — Trezor hardware has no disclosed entropy defect. Security commentary (Casa CEO Nick Neuman, cited in press coverage) tied the BitBox lure to the same shared Brevo compromise and framed the incident alongside other recent third-party-vendor breaches against hardware-wallet makers, including Trezor's own ShipMonk fulfillment-vendor breach (~80,689 customers' shipping data, disclosed within weeks of this incident) and a prior Ledger customer-data exposure tied to vendor Global-e — underscoring a pattern of attackers targeting the SaaS/vendor perimeter around hardware wallets rather than the devices themselves.

## MITRE ATT&CK

- T1583.006 Acquire Infrastructure: Web Services
- T1583.001 Acquire Infrastructure: Domains
- T1199 Trusted Relationship
- T1078.004 Valid Accounts: Cloud Accounts
- T1684.001 Impersonation
- T1566.002 Phishing: Spearphishing Link
- T1204.001 User Execution: Malicious Link
- T1078.004 Valid Accounts: Cloud Accounts
- T1036.005 Match Legitimate Resource Name or Location
- T1213 Data from Information Repositories
- T1657 Financial Theft

## Sources

- [Trezor Says 347,000 Users Received Phishing Emails After Brevo Hack](https://www.securityweek.com/trezor-says-347000-users-received-phishing-emails-after-brevo-hack/)
- [Security incident at Brevo, our third-party email provider](https://trezor.io/blog/news/security-incident-at-brevo-our-third-party-email-provider)
- [Trezor: 347,000 users targeted in phishing attacks after Brevo breach](https://www.bleepingcomputer.com/news/security/trezor-347-000-users-targeted-in-phishing-attacks-after-brevo-breach/)
- [Brevo Login Breach Affected Trezor, BitBox and CoinTracking](https://cointelegraph.com/news/brevo-login-flaw-trezor-bitbox-cointracking-phishing)
- [Trezor, BitBox & CoinTracking Phishing Attack: Brevo Breach Explained](https://thecybersecguru.com/news/trezor-bitbox-cointracking-brevo-phishing-attack/)
- [Attackers exploit fake STM32 vulnerability alert to target Trezor and BitBox holders](https://cryptoslate.com/attackers-exploit-fake-stm32-vulnerability-alert-to-target-trezor-and-bitbox-holders/)
- [Trezor phishing shows attackers can skip the device and target the human trust layer](https://www.cryptopolitan.com/trezor-phishing-shows-attackers-can-skip-the-device/)
- [Trezor Details Brevo Breach Behind Fake Security Alert](https://www.cryptotimes.io/2026/09/10/trezor-details-brevo-breach-behind-fake-security-alert/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2445