[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fCtzUfOvOCsb_ozlXpp427XHoWkou37aYol1cJP5qxJs":3},{"article":4,"iocs":51,"watch_terms":56,"solutions":57,"lesson":145},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"62139a4e-81b0-4c47-8195-8a50d8b41c20","Trezor: 347,000 users targeted in phishing attacks after Brevo breach","trezor-347-000-users-targeted-in-phishing-attacks-after-brevo-breach-42df19","Trezor has revealed that phishing attacks against its customers earlier this week targeted 347,000 email addresses and affected 2,500 users who clicked an embedded malicious link. [...]","Trezor has disclosed that a phishing campaign targeting 347,000 of its customers originated from a breach of its third-party email provider, Brevo. Threat actors gained access to Brevo's systems and used it to send fake security alert emails to Trezor customers, tricking 2,500 into clicking malicious links and downloading a fake app. Trezor has since suspended the Brevo account and taken down the phishing domain.","Trezor customers targeted in phishing attacks after Brevo email provider breach.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Ftrezor-347-000-users-targeted-in-phishing-attacks-after-brevo-breach\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F09\u002F11\u002FTrezor.jpg","2026-09-11T07:55:15+00:00","2026-09-11T08:00:03.478307+00:00",7,[17,20,22,25],{"name":18,"type":19},"Trezor","vendor",{"name":21,"type":19},"Brevo",{"name":23,"type":24},"ShinyHunters","threat_actor",{"name":26,"type":27},"Metabase","product","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":28,"icon":30,"name":31,"slug":32},null,"Threat Intelligence","threat-intelligence",[34,39,44,49],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":40},{"id":41,"icon":30,"name":42,"slug":43},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":45},{"id":46,"icon":30,"name":47,"slug":48},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":50},{"id":28,"icon":30,"name":31,"slug":32},[52],{"type":53,"value":54,"context":55},"email","help@trezor.io","Sender address used in phishing emails.",[18,21,26],{"controls":58,"vendors":144},[59,86,115],{"slug":60,"name":61,"problem":62,"products":63},"email-authentication","Email authentication (DMARC)","Nobody can send email that pretends to come from your domain.",[64,70,78],{"vendor_slug":65,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":65,"url":68,"description":69},"dmarcian","\u002Fvendor-logos\u002Fdmarcian.png","dmarcian-platform","https:\u002F\u002Fdmarcian.com\u002F","DMARC report processing and guidance for moving domains to enforcement.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"red-sift","Red Sift","\u002Fvendor-logos\u002Fred-sift.png","ondmarc","Red Sift OnDMARC","https:\u002F\u002Fredsift.com\u002Fpulse-platform\u002Fondmarc","Guided DMARC deployment and monitoring, with support for BIMI and MTA-STS.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"valimail","Valimail","\u002Fvendor-logos\u002Fvalimail.png","valimail-enforce","Valimail Enforce","https:\u002F\u002Fwww.valimail.com\u002Fproducts\u002Fenforce\u002F","Automated DMARC enforcement with discovery of every service that sends mail as your domain.",{"slug":87,"name":88,"problem":89,"products":90},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[91,99,107],{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"slug":116,"name":117,"problem":118,"products":119},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",[120,128,136],{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"securityscorecard","SecurityScorecard","\u002Fvendor-logos\u002Fsecurityscorecard.png","security-ratings","SecurityScorecard Ratings","https:\u002F\u002Fsecurityscorecard.com\u002Fsolutions\u002Fuse-cases\u002Fsecurity-ratings\u002F","Outside-in security ratings and monitoring of suppliers.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"onetrust","OneTrust","\u002Fvendor-logos\u002Fonetrust.png","third-party-management","OneTrust Third-Party Management","https:\u002F\u002Fwww.onetrust.com\u002Fsolutions\u002Fthird-party-management\u002F","Supplier inventory, risk assessments and monitoring across privacy and security.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"upguard","UpGuard","\u002Fvendor-logos\u002Fupguard.png","upguard-vendor-risk","UpGuard Vendor Risk","https:\u002F\u002Fwww.upguard.com\u002Fproduct\u002Fvendor-risk","Supplier security questionnaires, ratings and continuous monitoring.",[],{"slug":146,"title":147,"body":148,"framework_refs":149,"framework_notes":159},"third-party-email-provider-breach-exposes-347000-trezor-users-to-phishing","Third-Party Email Provider Breach Exposes 347,000 Trezor Users to Phishing","The Trezor incident illustrates how a breach at a third-party vendor can cascade into a direct attack on end customers, even when the primary organization has strong security practices. Threat actors compromised Brevo, Trezor's email service provider, and weaponized that trusted channel to deliver convincing phishing emails that bypassed user skepticism. Over 2,500 users clicked malicious links and downloaded a fake app, demonstrating that trusted sender reputation dramatically increases phishing success rates. This matters because cryptocurrency users are high-value targets, and any compromise of recovery phrases or credentials can result in irreversible financial loss. Organizations must treat their third-party vendors as extensions of their own attack surface.",[150,151,152,153,154,155,156,157,158],"CIS Control 15 – Service Provider Management","CIS Control 14 – Security Awareness and Skills Training","NIST SP 800-161 – Supply Chain Risk Management","NIST PR.AT-1 – Awareness and Training","NIST SR-6 – Supplier Assessments and Reviews","GDPR Article 28 – Processor Obligations","GDPR Article 33 – Notification of Data Breaches","ISO\u002FIEC 27036 – Information Security for Supplier Relationships","NIST AC-17 – Remote Access Controls",{}]