Brevo says an attacker abused SAML single sign-on in its marketing platform to send phishing mail to about 347,000 Trezor subscribers, with roughly 2,500 people clicking the malicious link before the site was taken down. Brevo says the attacker also accessed 138 accounts and exfiltrated contacts from 43 of them.
The setup was a trust-boundary mistake: the attacker created a Brevo account, turned on SSO, invited real Brevo users into that configuration, and then used those logins to reach every organization those users could access. That meant one compromised identity could touch several customer lists, so the blast radius was not limited to a single breached account.
For teams that rely on shared newsletter or marketing platforms, the exposure sits in the vendor’s cross-tenant access rules as much as in any one brand account. If those rules are too broad, a compromise can turn into trusted-looking phishing across unrelated customer bases, and the contacted lists remain a reachable asset even after the initial incident is contained.
Trezor: 347,000 users targeted in phishing attacks after Brevo breach
Trezor has revealed that phishing attacks against its customers earlier this week targeted 347,000 email addresses and affected 2,500 users who clicked an embedded malicious link.