{
 "slug": "brevo-flaw-trezor-bitbox-phishing-emails-sep-2026",
 "title": "Brevo login flaw lets attacker email a fake Trezor 'STM32 entropy' alert to 347,000 subscribers",
 "url": "https://drains.watch/i/brevo-flaw-trezor-bitbox-phishing-emails-sep-2026",
 "json": "https://drains.watch/i/brevo-flaw-trezor-bitbox-phishing-emails-sep-2026.json",
 "status": "closed",
 "severity": "medium",
 "threatStatus": "contained",
 "verification": "verified",
 "chains": [
  "bitcoin",
  "multi-evm"
 ],
 "method": "social-engineering",
 "product": "Trezor, BitBox and CoinTracking newsletter subscribers",
 "tags": [
  "bitcoin",
  "multi-evm",
  "social-engineering",
  "email-phishing",
  "seed-phishing",
  "hardware-wallet",
  "trezor",
  "bitbox",
  "cointracking",
  "brevo",
  "newsletter"
 ],
 "amountUsd": null,
 "victims": null,
 "startedAt": "2026-09-09",
 "closedAt": "2026-09-11",
 "updatedAt": "2026-09-11T12:00:00Z",
 "summary": "An attacker abused an authorization flaw in email platform Brevo to reach 138 client accounts and send phishing from six of them. One was a fake Trezor 'Critical Security Alert: STM32 Entropy Vulnerability' sent to about 347,000 Trezor newsletter subscribers, linking to an app that asked for wallet backups; BitBox's list and CoinTracking (a fake 'refresh API keys' email) were also used. Trezor took the phishing domain down within 20 minutes; about 2,500 people opened the link and no losses have been reported. Recipients should expect follow-up phishing to the same addresses.",
 "timeline": [
  {
   "date": "2026-09-09",
   "title": "Trezor and BitBox warned users about unauthorized emails sent through their Brevo accounts.",
   "sourceUrl": "https://cointelegraph.com/news/brevo-login-flaw-trezor-bitbox-cointracking-phishing"
  },
  {
   "date": "2026-09-10",
   "title": "Brevo's postmortem said 138 client accounts were accessed, six used to send phishing and contacts exported from 43.",
   "sourceUrl": "https://cointelegraph.com/news/brevo-login-flaw-trezor-bitbox-cointracking-phishing"
  },
  {
   "date": "2026-09-11",
   "title": "Cointelegraph reported about 2,500 people opened the Trezor phishing link before it was taken down, with no losses reported.",
   "sourceUrl": "https://cointelegraph.com/news/brevo-login-flaw-trezor-bitbox-cointracking-phishing"
  }
 ],
 "sources": [
  {
   "kind": "news",
   "title": "Brevo login flaw enabled phishing email targeting 347K Trezor subscribers",
   "url": "https://cointelegraph.com/news/brevo-login-flaw-trezor-bitbox-cointracking-phishing",
   "publisher": "Cointelegraph",
   "date": "2026-09-11"
  }
 ],
 "indicators": {
  "domains": [],
  "addresses": []
 },
 "brief": "## Am I affected?\nIf around 9 September 2026 you got a Trezor email about an 'STM32 entropy vulnerability', an unexpected BitBox email, or a CoinTracking email asking you to refresh API keys, and you entered your recovery phrase or wallet backup anywhere, your wallet is compromised.\n\n## What to do now\n- If you entered your seed: set up a new wallet with a new seed on a device you trust and move all funds now.\n- If you only opened the email: delete it. Your address is now on a phishing list, so expect more.\n- CoinTracking users: rotate exchange API keys from the exchange's own website.\n\n## How to avoid this\n- No wallet maker will ever ask for your recovery phrase or a wallet backup by email, app or website.\n- Get firmware and security notices only through the vendor's own app (Trezor Suite, BitBoxApp) or a website you type in yourself.",
 "notes": null,
 "agentBrief": "# Brevo login flaw lets attacker email a fake Trezor 'STM32 entropy' alert to 347,000 subscribers\n\n- Severity: Medium · Status: Contained (past)\n- Chains: Bitcoin, Multiple EVM chains · Method: Social engineering and fake support\n- Started: Sep 9, 2026 · Last update: Sep 11, 2026\n- Who/what: Trezor, BitBox and CoinTracking newsletter subscribers\n\nAn attacker abused an authorization flaw in email platform Brevo to reach 138 client accounts and send phishing from six of them. One was a fake Trezor 'Critical Security Alert: STM32 Entropy Vulnerability' sent to about 347,000 Trezor newsletter subscribers, linking to an app that asked for wallet backups; BitBox's list and CoinTracking (a fake 'refresh API keys' email) were also used. Trezor took the phishing domain down within 20 minutes; about 2,500 people opened the link and no losses have been reported. Recipients should expect follow-up phishing to the same addresses.\n\n## Am I affected?\nIf around 9 September 2026 you got a Trezor email about an 'STM32 entropy vulnerability', an unexpected BitBox email, or a CoinTracking email asking you to refresh API keys, and you entered your recovery phrase or wallet backup anywhere, your wallet is compromised.\n\n## What to do now\n- If you entered your seed: set up a new wallet with a new seed on a device you trust and move all funds now.\n- If you only opened the email: delete it. Your address is now on a phishing list, so expect more.\n- CoinTracking users: rotate exchange API keys from the exchange's own website.\n\n## How to avoid this\n- No wallet maker will ever ask for your recovery phrase or a wallet backup by email, app or website.\n- Get firmware and security notices only through the vendor's own app (Trezor Suite, BitBoxApp) or a website you type in yourself.\n\n## Sources\n- Brevo login flaw enabled phishing email targeting 347K Trezor subscribers (Cointelegraph, 2026-09-11): https://cointelegraph.com/news/brevo-login-flaw-trezor-bitbox-cointracking-phishing\n\nFull record: https://drains.watch/i/brevo-flaw-trezor-bitbox-phishing-emails-sep-2026 · JSON: https://drains.watch/i/brevo-flaw-trezor-bitbox-phishing-emails-sep-2026.json\n\nRules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support."
}