Brevo and Trezor: 347,000 phishing emails from a real sender

What happened

The message claimed that a vulnerability in the wallets' STM32 microcontroller exposed recovery phrases, in an urgent tone, with a link to an app that asked for exactly that secret, the one whose theft cannot be undone.

The decisive technical point: the phishing did not need to spoof the sender. The emails left Trezor's real Brevo account, with the real support address and valid domain authentication. Every signal that filters and users treat as proof of authenticity was green. A DMARC reject policy, which we recommend in our SPF, DKIM and DMARC guide, protects against spoofing; it can do nothing about mail sent from a compromised legitimate account.

Trezor's response limited the damage: domain taken down in 20 minutes, Brevo account suspended, prompt public disclosure. That speed came from preparation, and it is worth rehearsing before you need it.

A recurring pattern with third parties

This is the third incident hitting Trezor through a provider in under three years: its support portal compromised in January 2024 (66,000 users), then its logistics provider ShipMonk breached in August 2026 through a zero-day SQL injection in Metabase (81,000 customers, with extortion by ShinyHunters). None of Trezor's internal systems were compromised in these cases, yet its customers' data and its brand were exploited each time.

The flaw: the sending account is a key to your domain

A sending platform (Brevo, SendGrid, Mailchimp, Postmark, Resend) holds three things: the right to sign with your DKIM, your contact lists, and the trust your recipients place in your address. The usual weak points:

• user accounts without MFA, or shared between several people;
• full-access API keys, with no IP restriction, copied into several apps or a repository;
• mixed audiences: newsletter, security alerts and account emails in the same account;
• no alert on an unusual campaign, a new sender or a list export;
• former contractors (agency, freelancer) still members of the account.

The same logic applies to sending libraries themselves, as the npm worm targeting an email package showed.

How to test it

1. Inventory. List every platform allowed to send for your domains: read your SPF record and published DKIM selectors, then match each to an account.
2. Members and MFA. In each account, export the users, their role and MFA or SSO status. Spot former employees and contractors.
3. API keys. List the keys, their rights (send-only or full access), their IP restrictions and creation date. Look for them in your repositories and CI (see secrets in Git history).
4. Segmentation. Check whether a key used by the marketing site can send transactional emails or export the customer list.
5. Alerts. Create a test campaign to a small internal list from a secondary account and see whether anyone is notified.
6. Response. Time a drill: disable a sending account, revoke its keys and warn users. Trezor did it in 20 minutes.

How to fix it

• Mandatory SSO or MFA on every sending platform, named accounts only.
• Minimal-rights keys (send-only), IP-restricted where the platform allows it, stored in a vault, rotated.
• Separate accounts and subdomains for marketing and transactional mail.
• Alerts on new campaigns, new senders and exports.
• Contract clauses requiring incident notification within a set time.
• A consistent message to users: no legitimate alert ever asks for a recovery phrase, password or MFA code.

What does the Brevo and Trezor case mean for an AI agent?

An AI agent with an email-sending tool is one more sending platform, with the same flaw and an extra vector: it does not need to be hacked, only persuaded. A hidden instruction in a ticket or document can make it send, from your legitimate address, a message written by the attacker. In the other direction, an agent that reads your incoming mail will treat a message like Trezor's as genuine, since every check passes.

An agent's outbound emails should be limited to approved templates or require human confirmation. The Agent Red Team Express tests, in five days, whether your agent can be used to send phishing in your name.