⚠️ INCIDENT Z @Trezor: Brevo Turned Out to Be Part of a Much Larger Problem. Some time ago, I wrote about the compromise of Brevo’s email infrastructure, which was used to send phishing emails to Trezor users. Today, we know that 347,149 email addresses were exported from Trezor’s marketing list. But Brevo’s problems did not end there. On September 14, attackers used the compromised Cloudflare API key to deploy a malicious Cloudflare Worker. For approximately 5.5 hours, it allowed modification of web pages and JavaScript scripts delivered through Brevo’s infrastructure. According to Sansec, the potential scope affected over 100,000 websites using Brevo components. Selected users were shown a fake Cloudflare verification prompt,诱导 them to execute a Windows command leading to malware installation. For logged-in WordPress administrators, an attempt was also made to install a malicious plugin. There is currently no confirmation that this second attack targeted https://t.co/tatMoNAHpP, Trezor Suite, or Trezor device firmware. Trezor continues to state that its systems, wallets, and devices remain secure. However, this entire incident reveals something critical. First, an external provider’s infrastructure enabled phishing emails that appeared to come from Trezor. A few days later, the same provider’s infrastructure was used to deliver malicious code through legitimate websites and CDNs. A legitimate sender, HTTPS, or a correct domain are no longer sufficient guarantees that what you see is safe. Below, I’m providing two sources: Trezor’s official statement regarding its users, and Sansec’s analysis of the second attack. This clearly separates what Trezor has confirmed from what security researchers have uncovered. https://t.co/SwToyRL1V5 https://t.co/F6b5HWfpAn