Listen to the episode
TLDR
Attackers exploited a flaw in how email marketing platform Brevo handles SAML SSO, gaining access to 138 customer accounts. Six were used to send phishing emails to the stored contact lists, including roughly 347,000 subscribers of crypto...
How it works
Attackers exploited a flaw in how email marketing platform Brevo handles SAML SSO, gaining access to 138 customer accounts. Six were used to send phishing emails to the stored contact lists, including roughly 347,000 subscribers of crypto...
Red flags
- An "urgent critical security alert" about a hardware bug that pressures you to act immediately and install software via a link
- A request to enter your wallet recovery phrase, API key, or login credentials through a link in an unsolicited email
- The message comes from a known brand but on a topic you never signed up for, such as a sudden API key refresh notice
What to do
- 1Confirm any security warning by opening the company's official website or app directly, never through the email link
- 2Never type a recovery seed or API key into anything other than your physical hardware wallet
- 3If you entered your recovery phrase, move your funds to a freshly generated wallet right away and contact the provider
Source
malwarebytes
Source reviewed by Mythos Forensic Team
https://www.malwarebytes.com/blog/news/2026/09/crypto-customers-targeted-by-scammers-after-email-marketing-provider-breachFAQ
Is Crypto users hit by phishing emails after Brevo email marketing provider breach a real scam pattern?
Yes. Treat the message, call, or payment request as suspicious until you verify it through an official channel.
What are the first warning signs?
An "urgent critical security alert" about a hardware bug that pressures you to act immediately and install software via a link; A request to enter your wallet recovery phrase, API key, or login credentials through a link in an unsolicited email; The message comes from a known brand but on a topic you never signed up for, such as a sudden API key refresh notice
What should I do first?
Confirm any security warning by opening the company's official website or app directly, never through the email link; Never type a recovery seed or API key into anything other than your physical hardware wallet; If you entered your recovery phrase, move your funds to a freshly generated wallet right away and contact the provider
Can LegalAudit check my case?
Yes. Start a free chat and paste the message, link, sender, or payment details for triage.