Crypto customers targeted by scammers after email marketing provider breach

An attacker exploited a SAML SSO handling flaw in Brevo to access 138 customer accounts; six accounts were used to send phishing emails and 43 had contact lists exported. The phishing targeted cryptocurrency newsletter subscribers (notably Trezor’s ~347,000 subscribers) with convincing emails containing malicious links that asked recipients to download apps and enter wallet backups, creating a material risk of crypto theft and future targeted attacks.