Brevo login flaw enabled phishing email targeting 347K Trezor subscribers

An attacker exploited a flaw in email platform Brevo’s login system to access 138 client accounts, enabling a phishing email to reach roughly 347,000 Trezor newsletter subscribers and similar fraudulent messages to be distributed through accounts belonging to hardware wallet maker BitBox and crypto portfolio tracking and tax-reporting platform CoinTracking.In a Thursday postmortem, Brevo said six accounts were used to send phishing emails, contacts were exported from 43 and 93 accounts showed no meaningful activity. The platform did not specify whether the categories overlapped. The attacker created a Brevo account, enabled single sign-on and invited legitimate Brevo users into the configuration. Brevo said access should have been confined to that organization, but an authorization boundary failed and granted access to every organization the invited users could reach.The disclosure expands on warnings issued by Trezor and BitBox on Wednesday, identifying their shared provider and explaining why the emails passed normal authentication checks and appeared genuine. Cointelegraph reached out to Brevo for more information but did not receive a response before publication. Crypto firms a...