{
 "tag": "email-phishing",
 "name": "Email Phishing",
 "group": "Other",
 "incidents": [
  {
   "slug": "brevo-flaw-trezor-bitbox-phishing-emails-sep-2026",
   "title": "Brevo login flaw lets attacker email a fake Trezor 'STM32 entropy' alert to 347,000 subscribers",
   "url": "https://drains.watch/i/brevo-flaw-trezor-bitbox-phishing-emails-sep-2026",
   "json": "https://drains.watch/i/brevo-flaw-trezor-bitbox-phishing-emails-sep-2026.json",
   "status": "closed",
   "severity": "medium",
   "threatStatus": "contained",
   "verification": "verified",
   "chains": [
    "bitcoin",
    "multi-evm"
   ],
   "method": "social-engineering",
   "product": "Trezor, BitBox and CoinTracking newsletter subscribers",
   "tags": [
    "bitcoin",
    "multi-evm",
    "social-engineering",
    "email-phishing",
    "seed-phishing",
    "hardware-wallet",
    "trezor",
    "bitbox",
    "cointracking",
    "brevo",
    "newsletter"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-09-09",
   "closedAt": "2026-09-11",
   "updatedAt": "2026-09-11T12:00:00Z",
   "summary": "An attacker abused an authorization flaw in email platform Brevo to reach 138 client accounts and send phishing from six of them. One was a fake Trezor 'Critical Security Alert: STM32 Entropy Vulnerability' sent to about 347,000 Trezor newsletter subscribers, linking to an app that asked for wallet backups; BitBox's list and CoinTracking (a fake 'refresh API keys' email) were also used. Trezor took the phishing domain down within 20 minutes; about 2,500 people opened the link and no losses have been reported. Recipients should expect follow-up phishing to the same addresses."
  },
  {
   "slug": "lovable-ai-built-aave-phishing-sites-jun-2025",
   "title": "Phishing campaign used the AI site builder Lovable to fake Aave and push wallet connections",
   "url": "https://drains.watch/i/lovable-ai-built-aave-phishing-sites-jun-2025",
   "json": "https://drains.watch/i/lovable-ai-built-aave-phishing-sites-jun-2025.json",
   "status": "closed",
   "severity": "medium",
   "threatStatus": "partly-contained",
   "verification": "verified",
   "ai": {
    "role": "ai-lure",
    "note": "Proofpoint says criminals are increasingly using the AI website builder Lovable to create and host phishing sites, and the Aave lure was a Lovable-built app."
   },
   "chains": [
    "multi-evm"
   ],
   "method": "fake-airdrop-site",
   "product": "Aave and other DeFi users receiving fake reward emails",
   "tags": [
    "multi-evm",
    "fake-airdrop-site",
    "aave",
    "lovable",
    "ai-website-builder",
    "email-phishing",
    "sendgrid",
    "wallet-connect",
    "proofpoint",
    "drainer",
    "ai"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2025-06-17",
   "closedAt": "2025-08-20",
   "updatedAt": "2025-08-20T12:00:00Z",
   "summary": "Proofpoint reported on 20 August 2025 that criminals were using Lovable, an AI website builder that makes sites from text prompts, to create and host phishing and wallet-drainer pages. In June 2025 nearly 10,000 emails sent through SendGrid led to a Lovable-built app that redirected to a fake Aave site asking people to connect a crypto wallet; Proofpoint said the likely aim was to steal assets from any connected wallet. Lovable removed a phishing cluster and added real-time checks after the report. No loss figures were published."
  }
 ],
 "changes": [
  {
   "incident": "brevo-flaw-trezor-bitbox-phishing-emails-sep-2026",
   "incidentTitle": "Brevo login flaw lets attacker email a fake Trezor 'STM32 entropy' alert to 347,000 subscribers",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-09-11",
   "title": "Cointelegraph reported about 2,500 people opened the Trezor phishing link before it was taken down, with no losses reported.",
   "sourceUrl": "https://cointelegraph.com/news/brevo-login-flaw-trezor-bitbox-cointracking-phishing",
   "url": "https://drains.watch/i/brevo-flaw-trezor-bitbox-phishing-emails-sep-2026"
  },
  {
   "incident": "brevo-flaw-trezor-bitbox-phishing-emails-sep-2026",
   "incidentTitle": "Brevo login flaw lets attacker email a fake Trezor 'STM32 entropy' alert to 347,000 subscribers",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-09-10",
   "title": "Brevo's postmortem said 138 client accounts were accessed, six used to send phishing and contacts exported from 43.",
   "sourceUrl": "https://cointelegraph.com/news/brevo-login-flaw-trezor-bitbox-cointracking-phishing",
   "url": "https://drains.watch/i/brevo-flaw-trezor-bitbox-phishing-emails-sep-2026"
  },
  {
   "incident": "brevo-flaw-trezor-bitbox-phishing-emails-sep-2026",
   "incidentTitle": "Brevo login flaw lets attacker email a fake Trezor 'STM32 entropy' alert to 347,000 subscribers",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-09-09",
   "title": "Trezor and BitBox warned users about unauthorized emails sent through their Brevo accounts.",
   "sourceUrl": "https://cointelegraph.com/news/brevo-login-flaw-trezor-bitbox-cointracking-phishing",
   "url": "https://drains.watch/i/brevo-flaw-trezor-bitbox-phishing-emails-sep-2026"
  },
  {
   "incident": "lovable-ai-built-aave-phishing-sites-jun-2025",
   "incidentTitle": "Phishing campaign used the AI site builder Lovable to fake Aave and push wallet connections",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2025-08-20",
   "title": "Proofpoint published its research on Lovable abuse; Lovable said it had removed a phishing cluster and added real-time detection.",
   "sourceUrl": "https://www.proofpoint.com/us/blog/threat-insight/cybercriminals-abuse-ai-website-creation-app-phishing",
   "url": "https://drains.watch/i/lovable-ai-built-aave-phishing-sites-jun-2025"
  },
  {
   "incident": "lovable-ai-built-aave-phishing-sites-jun-2025",
   "incidentTitle": "Phishing campaign used the AI site builder Lovable to fake Aave and push wallet connections",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2025-06-17",
   "title": "Proofpoint first saw the Aave-themed lure, a Lovable app linked from SendGrid emails.",
   "sourceUrl": "https://www.proofpoint.com/us/blog/threat-insight/cybercriminals-abuse-ai-website-creation-app-phishing",
   "url": "https://drains.watch/i/lovable-ai-built-aave-phishing-sites-jun-2025"
  }
 ]
}