Trezor warns of 347,000 phishing emails after Brevo breach

Trezor said a cyberattack on Brevo, the marketing technology company it uses to send newsletters, let hackers send roughly 347,000 phishing emails to Trezor customers with a malicious link purporting to come from the wallet maker. Brevo said attackers accessed 138 accounts and abused a flaw that left their access "not properly scoped," wrongly granting reach across organizations. Trezor said its products, wallets and account system were unaffected. The link downloads an app that asks for the wallet backup password; a stolen password lets an attacker irreversibly take funds on the public blockchain. Trezor said it is reevaluating vendor relationships and warned addresses may be reused in future phishing.