Brevo login vulnerability leads to phishing emails sent to 347,000 Trezor subscribers

iconKuCoinFlash
Share
AI summary iconSummary
A vulnerability in Brevo’s login system allowed attackers to access 138 accounts, resulting in phishing emails being sent to 347,000 Trezor subscribers. The scam targeted users with a fake “STM32 Entropy Vulnerability” message, directing them to a site claiming to offer wallet backups. Trezor disabled the domain within 20 minutes, but 2,500 users still clicked the link. Brevo stated the breach exploited a single sign-on flaw, granting attackers access to data from 43 accounts, six of which were used to send phishing emails. BitBox and CoinTracking confirmed that no credentials or funds were compromised.

Odaily Planet Daily report: A login system vulnerability at the email platform Brevo allowed attackers to access 138 customer accounts and send phishing emails to approximately 347,000 Trezor newsletter subscribers. Accounts from BitBox and the cryptocurrency portfolio and tax reporting platform CoinTracking were also used to send similar fraudulent emails.

Trezor stated that the phishing email had the subject line “Critical Security Alert: STM32 Entropy Vulnerability,” with a link directing users to an application requesting their wallet backup. Trezor disabled the associated domain via DNS within 20 minutes, but approximately 2,500 people had visited the link; the risk has been communicated to all 347,000 subscribers.

Brevo stated that attackers exploited a misconfiguration in the single sign-on permission boundaries to access all organizations reachable by invited users; six accounts were used to send phishing emails, and contact data from 43 accounts was exfiltrated. BitBox and CoinTracking reported no evidence of compromised company credentials, funds, or recovery phrases, but have treated the associated email addresses as potentially accessed. (Cointelegraph)

Source:Show original
Disclaimer: The information on this page may have been obtained from third parties and does not necessarily reflect the views or opinions of KuCoin. This content is provided for general informational purposes only, without any representation or warranty of any kind, nor shall it be construed as financial or investment advice. KuCoin shall not be liable for any errors or omissions, or for any outcomes resulting from the use of this information. Investments in digital assets can be risky. Please carefully evaluate the risks of a product and your risk tolerance based on your own financial circumstances. For more information, please refer to our Terms of Use and Risk Disclosure.