Brevo Login Vulnerability Compromises 138 Client Accounts, Leading to Widespread Phishing Attacks on Trezor, BitBox, and CoinTracking Subscribers

A significant security incident has impacted users of several prominent cryptocurrency-related platforms, stemming from a vulnerability exploited in the login system of email marketing service Brevo. The breach resulted in the unauthorized access of 138 client accounts on Brevo, which were subsequently used to distribute phishing emails. These malicious messages ultimately reached approximately 347,000 subscribers of the Trezor newsletter, along with similar fraudulent communications sent through compromised accounts belonging to hardware wallet maker BitBox and crypto portfolio tracking and tax-reporting platform CoinTracking.

In a detailed postmortem released on Thursday, Brevo confirmed that six of its client accounts were actively used to send phishing emails. The company further disclosed that contact lists were exported from 43 accounts, while 93 accounts showed no "meaningful activity" during the incident. Brevo did not specify whether the accounts categorized under these different types of activity overlapped.

The attacker’s method involved creating a new Brevo account and then enabling single sign-on (SSO) functionality. This compromised account then invited legitimate Brevo users into its configuration. According to Brevo’s explanation, the intended security perimeter should have confined access to the attacker’s own organization. However, a critical authorization boundary failure occurred, inadvertently granting the attacker access to every organization that the invited legitimate users could reach within the Brevo platform.

This disclosure provides crucial context and expands upon earlier warnings issued by Trezor and BitBox on Wednesday. At that time, these companies had alerted their users to the phishing attempts and identified their shared email service provider as the point of compromise. Their initial statements explained why the fraudulent emails managed to bypass normal authentication checks and appear to be legitimate communications. Cointelegraph attempted to obtain further information directly from Brevo for this report but did not receive a response prior to publication.

Crypto Firms Assess Potential Subscriber Exposure and Impact

Following the incident, the affected cryptocurrency firms have been actively assessing the potential exposure of their subscriber bases and informing their users about the risks.

Trezor, in a blog post, detailed that the phishing message, ominously titled “Critical Security Alert: STM32 Entropy Vulnerability,” contained a malicious link. Upon clicking this link, users were directed to an application that requested their wallet backups, a highly sensitive piece of information. The hardware wallet manufacturer stated that it acted swiftly to disable the malicious domain at the DNS level within approximately 20 minutes of discovery. Despite this rapid response, an estimated 2,500 individuals had already accessed the link before it was taken down.

A spokesperson for Trezor confirmed to Cointelegraph that the initial phishing email was sent to a list of 347,000 customers. All of these individuals have since been contacted by Trezor to inform them about the potential risk. Trezor clarified that its Brevo account was exclusively used to store opt-in newsletter email addresses and did not contain any other customer data, such as personal identifiable information or transaction history.

"Until we hear more from Brevo, we are treating all roughly 347,000 newsletter addresses as known to the attacker and possibly reusable for phishing," the Trezor spokesperson stated, underscoring the ongoing caution and the need for users to remain vigilant.

Similarly, a spokesperson for BitBox informed Cointelegraph that their unauthorized email was also distributed through Brevo and appeared to have reached their entire newsletter and tutorial subscriber list. BitBox indicated that their Brevo account contained only email addresses and language preferences for their users. The company reported finding no evidence of compromised company credentials, downloaded contact lists, lost funds, or disclosed recovery phrases. Nevertheless, BitBox stated that it is treating its subscriber list as potentially accessed while awaiting further details and logs from Brevo.

CoinTracking, another affected platform, took to its official X (formerly Twitter) account to announce the incident. The company reported that its Brevo account distributed an email with the subject line “Data Breach Notice: Please refresh API Keys as soon as possible.” CoinTracking issued a strong warning to its users, explicitly advising them not to follow any links within the fraudulent email, thereby reinforcing the phishing nature of the communication.

The incident highlights the critical importance of robust security measures within third-party service providers, especially those handling sensitive customer data and communication channels for businesses in the cybersecurity and cryptocurrency sectors. The interconnectedness of these platforms means that a vulnerability in one can have cascading effects across many, underscoring the need for continuous vigilance and thorough security audits at all levels of the digital ecosystem. As Brevo continues its investigation and provides further information, affected users are advised to remain alert for any suspicious communications and to follow the security guidance issued by Trezor, BitBox, and CoinTracking.