Cold cryptocurrency storage provider Trezor says roughly 347,000 of its customers received phishing emails after a third-party marketing platform used by the company was hacked.
The incident involved the marketing platform Brevo, which Trezor uses for newsletters. Brevo said an attacker exploited how it handles SAML Single Sign-On (SSO) to access 138 accounts.
“The attacker created a Brevo account and enabled single sign-on (SSO) on it, then invited legitimate Brevo users into that SSO configuration. Using their own identity provider, they were able to sign in as those invited users, which by itself is expected behavior for SSO,” Brevo explained.
“This access was not properly scoped: instead of being limited to the single organization where SSO was enabled, it wrongly granted the attacker access to all organizations those users could reach,” it added.
According to the company, the attacker sent phishing messages to the email addresses stored under six of the compromised accounts. In addition, the threat actor exfiltrated contacts from 43 accounts.
One of the customers whose email list was abused for a phishing campaign appears to be Trezor, which informed customers on Thursday that the attacker sent phishing messages to 347,000 email addresses stored in the Brevo account.
The phishing emails had the subject line “Critical Security Alert: STM32 Entropy Vulnerability” and contained a link pointing to a malicious website.
Trezor has not shared details about the malicious site, but warned customers that their funds could be lost if they clicked on the link and entered their wallet backup.
According to Trezor, only 2,500 users clicked on the link before the malicious website was taken offline 20 minutes after the incident was detected. It’s unclear how many users may have lost funds and how much.
Swiss Bitcoin hardware wallet maker BitBox and crypto tax calculator CoinTracking also appear to have been hit by the Brevo hack, but they haven’t shared details on the impact and have not named Brevo as the source of the incident.
The incident comes less than a month after Trezor admitted that the personal information of nearly 14,000 people was compromised in a data breach affecting its third-party shipping provider ShipMonk.
An update Trezor shared on September 4 revealed that the ShipMonk leak affects an additional 67,000 US customers, including their name, email, shipping address, phone number, and order number.
Both incidents could lead to a surge in phishing attacks targeting Trezor customers.
Related: Surfshark Systems Targeted by Hackers
Related: 4.1 Million Impacted by AdaptHealth Data Breach
Related: Mathspace Data Breach Exposes Over 1 Million People
