Brevo traces Trezor phishing campaign to a single sign-on flaw

Brevo has traced the breach behind Trezor's fraudulent security email to a flaw in its single sign-on controls. The email provider says an attacker reached 138 customer accounts, while Trezor's September 17 update says 347,149 marketing email contacts were exported from its list through Brevo's API. The findings expand the initial September 9 warning, which did not identify a cause or audience count.

Brevo's postmortem says a login through one organization's SAML configuration could improperly reach other organizations accessible to the same user. The attacker exploited that missing boundary after setting up an account and inviting legitimate users into its single sign-on configuration. Brevo says it closed the entry point at 8:30 a.m. UTC on September 10 and signed out all users.

The provider reports that six accounts sent phishing emails and contacts were exported from 43 accounts. Those are platform-wide figures; Trezor's later notice separately confirms the 347,149 contacts exported from its list.

The fake alert used a trusted sending channel

Trezor's original warning identified the supposed STM32 security alert as phishing. Its September 9 notice remains relevant to recognizing that message:

Brevo says the malicious messages traveled through legitimate infrastructure and passed ordinary email authentication checks. A recognizable sender therefore did not establish that the requested action was safe. The provider says it disabled the links and described a permanent change to confine single sign-on access to the organization that owns the configuration.

Trezor says the message linked to an app that requested a wallet backup. The company reports taking down the domain within 20 minutes, after about 2,500 recipients had clicked. It says no Trezor product, wallet or account system was affected, and that the email platform held no passwords or wallet data.

Exposure and losses remain different questions

SecurityWeek's September 11 report says the number of people who may have lost funds, and the amount, remained unclear. The click count should therefore not be read as a count of stolen wallets. The report also places the incident alongside the separate breach at shipping provider ShipMonk; shipping-record exposure should not be attributed to this newsletter incident.

Malwarebytes advises recipients of urgent security messages to check the company's official website or app independently and avoid installing software through unsolicited links. Trezor says it never asks customers for their wallet backup. Anyone who entered a backup through the phishing message should follow the company's official recovery guidance immediately. The remaining risk is targeted phishing against the exposed addresses, not evidence that Trezor devices or wallet systems were compromised.