Brevo Security Flaw Exposes Thousands to Phishing Attacks

A security flaw in Brevo's email platform exposed thousands of cryptocurrency users to phishing attacks. The breach, which occurred through an authorization-boundary failure, allowed a threat actor to access 138 client accounts and send fake security alerts to approximately 347,000 newsletter subscribers.

The attacker created a Brevo account, enabled single sign-on, and invited Brevo users into it. This opened the door for phishing campaigns that passed normal authentication checks and appeared legitimate to recipients. The phishing emails directed users to an app that requested wallet backups, which could have given attackers control over funds.

Trezor, a cryptocurrency hardware wallet provider, was affected through its Brevo account. It disabled the malicious domain within 20 minutes but not before about 2,500 people had opened the link initially. Trezor is treating all 347,000 addresses as potentially reusable for future phishing attempts.