A Brevo SAML SSO Breach Turned Real Newsletters Into Phishing Email

A Brevo SAML single sign-on flaw let an attacker send phishing from the genuine newsletter accounts of Trezor, BitBox and CoinTracking, so the emails passed the usual authentication checks and looked like the companies' own mail.

Threat Watch has covered real Dell and Staples emails carrying callback scams, and the AegisAI blog explains why DMARC-passing email can still be phishing. This case goes one step further: the attacker did not borrow a brand's mail, it sent from the brand's own sending account. The emails went out on 9 and 10 September 2026, and the sources here are the statements Brevo, Trezor, BitBox and CoinTracking published themselves.

What happened in the Brevo SAML SSO breach?

Brevo, the email marketing platform formerly called Sendinblue, published a write-up of the incident on its status page. It says it identified the activity at 6:30 UTC on 10 September 2026, closed the route and signed out all users at 8:30 UTC the same day, and is contacting each affected customer.

An invitation that crossed organizations

The attacker created a new Brevo account, enabled single sign-on on it and invited legitimate Brevo users into that configuration. Once a user was invited, the attacker could sign in as that user through the user's own identity provider, which Brevo calls normal single sign-on behaviour. Brevo names the root cause as a boundary that was not enforced: the access was meant to stay inside the one organization where single sign-on was turned on, and it carried over into every organization the invited users belonged to.

What the attacker did with 138 accounts

Brevo says the attacker gained access to 138 Brevo accounts. It used 6 of them to send phishing to the contacts stored there, exported the contacts of 43, and Brevo reports no meaningful activity in 93. Those three groups add up to more than 138, so some accounts appear in more than one. Brevo says invitations into single sign-on configurations stay switched off until a permanent fix, which it describes as being deployed, is in place.

Can a phishing email pass SPF, DKIM and DMARC and still be a scam?

Yes, when the attacker sends through the real sender's own platform account. SPF, DKIM and DMARC check that a message was sent by infrastructure the domain owner authorized and that the signature matches. In this case the infrastructure was the one Trezor and the others had authorized, Brevo's, so the checks had nothing to reject. Brevo's write-up says only that the mail "passed the usual email authentication checks"; it does not list each check, and the link between those checks and Brevo's authorization is AegisAI's reading.

A known sender, a known domain

The Register reported, from copies shared by recipients, that the Trezor email came from a Trezor mailing address. That removes the signals a filter or a person usually leans on: no lookalike domain, no new sender, no authentication failure. What was left was the content of the message and the place its link led.

How did the Trezor, BitBox and CoinTracking lures work?

Trezor: a fake hardware flaw

Trezor says the email carried the subject "Critical Security Alert: STM32 Entropy Vulnerability" and that its link prompted users to download an app that then asked them to enter their wallet backup. The Register reported that the email claimed an estimated one in four Trezor devices had a hardware factory defect. Trezor states that no Trezor product, wallet or account system was affected and that it will never ask for a wallet backup.

BitBox: the same story, its own brand

BitBox's support page describes two Brevo phishing campaigns on 10 September 2026 that used a "Microcontroller Entropy" flaw as the lure and pointed to a site asking for the wallet's recovery words. The Register gives the subject as "Critical Security Alert: Microcontroller Entropy Bug Identified."

CoinTracking: a breach notice about API keys

CoinTracking does not sell hardware wallets, so its version was different. It says some users received an email on 9 September with the subject "Data Breach Notice: Please refresh API Keys as soon as possible." CoinTracking says its own systems were not compromised and that Brevo's review found no CoinTracking addresses exported.

Why standard controls miss it

This section is AegisAI's analysis; the companies' statements describe the incident, not the gaps. Email authentication proves where a message came from, and here it came from exactly where it claimed to. Sender reputation was high because the newsletter was a long-standing, opt-in send that subscribers expected. Rules that flag new domains or failed DMARC had nothing to match.

The weak point sits upstream, in the email platform. Marketing and newsletter accounts often have broad sending rights and large contact lists, and they are managed outside the main identity controls. A flaw in how one of those platforms scopes single sign-on turned six customer accounts into trusted phishing senders at once.

How AegisAI protects against it

When a message like this reaches a work inbox, a passing authentication result and a known sender are not the end of the decision.

Aegis does not classify infrastructure. It classifies intent. A lure with no attacker-owned infrastructure still has to ask the recipient to do something on the attacker's behalf, and that request is what gets classified, independent of how clean the destination URL is.

AegisAI's agents evaluate the message and the destination it points to together, and pull a malicious message out of mailboxes before users see or click it.

Book a demo How inbound protection works

How AegisAI stops credential phishing, 48 seconds

Recommendations for defenders

• List every third-party platform that sends email in the company's name, and check on each one who can sign in, whether single sign-on invitations can reach the account, and whether access is limited to the company's own organization.
• Require multi-factor sign-in and least-privilege roles on email service provider and CRM accounts, and treat them as sending identities, not marketing tools.
• Alert on unusual outbound activity from those accounts: unplanned campaigns, new subject lines, sends outside working hours and bulk contact exports.
• Keep a takedown playbook ready for phishing domains that abuse the brand. Trezor's 20-minute DNS takedown is the benchmark here; the link between speed and the low click count is AegisAI's reading.
• After an exposure, tell customers plainly that the company will never ask for a recovery phrase, password or API key by email, and expect follow-up phishing against the exported list.

FAQ