{
 "tag": "seed-phishing",
 "name": "Seed Phishing",
 "group": "Other",
 "incidents": [
  {
   "slug": "brevo-flaw-trezor-bitbox-phishing-emails-sep-2026",
   "title": "Brevo login flaw lets attacker email a fake Trezor 'STM32 entropy' alert to 347,000 subscribers",
   "url": "https://drains.watch/i/brevo-flaw-trezor-bitbox-phishing-emails-sep-2026",
   "json": "https://drains.watch/i/brevo-flaw-trezor-bitbox-phishing-emails-sep-2026.json",
   "status": "closed",
   "severity": "medium",
   "threatStatus": "contained",
   "verification": "verified",
   "chains": [
    "bitcoin",
    "multi-evm"
   ],
   "method": "social-engineering",
   "product": "Trezor, BitBox and CoinTracking newsletter subscribers",
   "tags": [
    "bitcoin",
    "multi-evm",
    "social-engineering",
    "email-phishing",
    "seed-phishing",
    "hardware-wallet",
    "trezor",
    "bitbox",
    "cointracking",
    "brevo",
    "newsletter"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-09-09",
   "closedAt": "2026-09-11",
   "updatedAt": "2026-09-11T12:00:00Z",
   "summary": "An attacker abused an authorization flaw in email platform Brevo to reach 138 client accounts and send phishing from six of them. One was a fake Trezor 'Critical Security Alert: STM32 Entropy Vulnerability' sent to about 347,000 Trezor newsletter subscribers, linking to an app that asked for wallet backups; BitBox's list and CoinTracking (a fake 'refresh API keys' email) were also used. Trezor took the phishing domain down within 20 minutes; about 2,500 people opened the link and no losses have been reported. Recipients should expect follow-up phishing to the same addresses."
  },
  {
   "slug": "chrome-edge-19-extensions-wallet-drainer-aug-2026",
   "title": "19 Chrome and Edge extensions hid a wallet drainer that hijacked Connect Wallet and Swap buttons",
   "url": "https://drains.watch/i/chrome-edge-19-extensions-wallet-drainer-aug-2026",
   "json": "https://drains.watch/i/chrome-edge-19-extensions-wallet-drainer-aug-2026.json",
   "status": "live",
   "severity": "high",
   "threatStatus": "partly-contained",
   "verification": "verified",
   "chains": [
    "multi-evm",
    "solana",
    "tron"
   ],
   "method": "malicious-extension",
   "product": "Users of 19 Chrome/Edge extensions incl. 'Enable Right Click & Copy', 'Multi-Chain Explorer' and 'LedgerLook: Wallet Checker'",
   "tags": [
    "multi-evm",
    "solana",
    "tron",
    "malicious-extension",
    "chrome",
    "edge",
    "browser-extension",
    "extension-takeover",
    "seed-phishing",
    "clickfix",
    "ledger",
    "trezor",
    "metamask",
    "socket"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-08-30",
   "closedAt": null,
   "updatedAt": "2026-08-30T12:00:00Z",
   "summary": "Socket found 19 Chrome and Edge extensions, from crypto price trackers and explorers to general tools like 'Enable Right Click & Copy' (70,000+ Chrome users), that loaded a modular malware framework. It drained EVM, Solana and Tron wallets by hijacking 'Connect Wallet' and 'Swap' buttons, swapped Ledger and Trezor sites for seed-phishing pages and stole exchange sessions; five extensions were bought from their original developers and turned malicious through updates. Socket thinks the campaign may date back to early 2024. Google removed the Chrome listings, but when BleepingComputer reported it on 30 August 2026 the Edge version of one was still available."
  }
 ],
 "changes": [
  {
   "incident": "brevo-flaw-trezor-bitbox-phishing-emails-sep-2026",
   "incidentTitle": "Brevo login flaw lets attacker email a fake Trezor 'STM32 entropy' alert to 347,000 subscribers",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-09-11",
   "title": "Cointelegraph reported about 2,500 people opened the Trezor phishing link before it was taken down, with no losses reported.",
   "sourceUrl": "https://cointelegraph.com/news/brevo-login-flaw-trezor-bitbox-cointracking-phishing",
   "url": "https://drains.watch/i/brevo-flaw-trezor-bitbox-phishing-emails-sep-2026"
  },
  {
   "incident": "brevo-flaw-trezor-bitbox-phishing-emails-sep-2026",
   "incidentTitle": "Brevo login flaw lets attacker email a fake Trezor 'STM32 entropy' alert to 347,000 subscribers",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-09-10",
   "title": "Brevo's postmortem said 138 client accounts were accessed, six used to send phishing and contacts exported from 43.",
   "sourceUrl": "https://cointelegraph.com/news/brevo-login-flaw-trezor-bitbox-cointracking-phishing",
   "url": "https://drains.watch/i/brevo-flaw-trezor-bitbox-phishing-emails-sep-2026"
  },
  {
   "incident": "brevo-flaw-trezor-bitbox-phishing-emails-sep-2026",
   "incidentTitle": "Brevo login flaw lets attacker email a fake Trezor 'STM32 entropy' alert to 347,000 subscribers",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-09-09",
   "title": "Trezor and BitBox warned users about unauthorized emails sent through their Brevo accounts.",
   "sourceUrl": "https://cointelegraph.com/news/brevo-login-flaw-trezor-bitbox-cointracking-phishing",
   "url": "https://drains.watch/i/brevo-flaw-trezor-bitbox-phishing-emails-sep-2026"
  },
  {
   "incident": "chrome-edge-19-extensions-wallet-drainer-aug-2026",
   "incidentTitle": "19 Chrome and Edge extensions hid a wallet drainer that hijacked Connect Wallet and Swap buttons",
   "severity": "high",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-08-30",
   "title": "BleepingComputer reported Socket's discovery of 19 malicious Chrome and Edge extensions; the Chrome versions were gone but one Edge version was still live.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/chrome-web-store-extensions-caught-stealing-crypto-browser-data/",
   "url": "https://drains.watch/i/chrome-edge-19-extensions-wallet-drainer-aug-2026"
  }
 ]
}