Trezor Says 347,000 Users Received Phishing Emails After Brevo Hack

Hackers compromised the Brevo marketing platform by exploiting its SAML Single Sign-On (SSO) implementation, gaining unauthorized access to multiple customer accounts. Using this access, attackers sent phishing emails to approximately 347,000 Trezor users, among others, with malicious links designed to steal wallet backups. About 2,500 users clicked the phishing link before the malicious site was taken offline. The incident also involved exfiltration of contact data from 43 Brevo accounts. Other affected customers include BitBox and CoinTracking. This breach follows a recent data leak involving Trezor's third-party shipping provider, increasing the risk of targeted phishing attacks.

• securityweek.com/trezor-says-347000-users-received-phishing-emails-after-brevo-hack/ (opens in a new tab)

• Microsoft Teams to get AI-powered, context-aware phishing detectionNews2026-10-23
• Technology that blocks DGA domains | Kaspersky official blogAnalysis2026-10-23
• 2026 Year End Phishing LuresCampaign2026-10-22
• Machine speed attacks require machine speed detection and responseAnalysis2026-10-22
• How Tenable brought multi-language support to security detectors with agentic translationAnalysis2026-10-21