Trezor Phishing Campaign After Brevo Breach: 347,000 Users Targeted — Detection and Response Guide

Trezor has disclosed that a social engineering campaign against its customer base this week targeted 347,000 email addresses, with approximately 2,500 users clicking an embedded malicious link. The source of the exposure wasn't Trezor's own infrastructure — it was Brevo (formerly Sendinblue), the third-party email marketing and CRM platform Trezor uses to communicate with customers. Attackers obtained customer contact data from Brevo and weaponized it within days, launching convincing phishing emails that impersonated Trezor communications.

This is a textbook supply-chain-adjacent social engineering event: your perimeter can be spotless, your endpoints fully patched, and your users still get burned because a marketing vendor leaked the one dataset that makes phishing irresistible — a verified list of people known to own a specific high-value product. For cryptocurrency hardware wallet users, that product secures private keys. A single successful phish that harvests a recovery seed means irreversible, untraceable theft of funds. There is no fraud department to call.

For defenders, this incident matters on two fronts: (1) organizations whose employees hold crypto assets are now facing a targeted, well-aimed phishing wave, and (2) it's a live case study in third-party data exposure driving immediate downstream attacks. This post breaks down the attack chain, provides detection content for email and endpoint telemetry, and lays out remediation steps for both enterprises and wallet holders.

Technical Analysis

What Happened

• Source of exposure: Brevo, Trezor's third-party email service provider, suffered a breach that exposed Trezor customer contact records — primarily email addresses associated with Trezor accounts and newsletter/shop registrations.
• Scope: 347,000 email addresses were targeted with phishing messages. Trezor confirmed roughly 2,500 recipients clicked the embedded malicious link.
• Attack vector: Emails impersonating official Trezor communications (e.g., fake security alerts, firmware update notices, or "verify your wallet" lures) containing links to attacker-controlled phishing pages designed to harvest wallet recovery seeds or credentials.
• Impact mechanism: Unlike credential phishing against a web service, seed-phrase phishing against hardware wallet users is immediately monetizable. Once a victim types their 12/24-word recovery seed into a phishing page, the attacker can restore the wallet on their own device and drain funds within minutes.

Attack Chain (Defender's View)

1. Collection: Attacker obtains 347K email addresses from the Brevo breach — a pre-qualified target list of known hardware wallet owners.
2. Delivery: Phishing emails sent spoofing or imitating Trezor branding and sender patterns. Because recipients expect email from Trezor, open rates are far higher than generic phishing.
3. Click: Victim clicks the embedded link. Trezor's telemetry confirms ~2,500 clicks (~0.7% click rate — consistent with high-quality targeted lists).
4. Harvest: Landing page impersonates Trezor Suite or a security verification flow, prompting for the recovery seed, wallet PIN, or a malicious "firmware update" download.
5. Monetization: Seeds entered are used to restore wallets attacker-side; funds are moved to attacker-controlled addresses. In some variants, the lure delivers malware (clipboard hijackers, wallet-drainers) instead of pure seed harvesting.

Why This Campaign Is More Dangerous Than Average Phishing

• List quality: This is not scraped data. Every address is a confirmed Trezor customer — a 100% relevant audience.
• Trust context: Victims have a pre-existing email relationship with the impersonated sender. SPF/DKIM alignment on lookalike domains still passes user scrutiny because the content is expected.
• No recovery path: Stolen crypto is gone. Incident response shifts from "reset the password" to "race the attacker to move remaining funds."
• Exploitation status: Confirmed active, in-the-wild exploitation with measured victim counts. No CVE applies — this is pure social engineering enabled by third-party data exposure. There is no patch; the controls are email security, user behavior, and wallet hygiene.

Detection & Response

For SOC teams, the detection surface here is threefold: (1) inbound email impersonating Trezor hitting corporate mailboxes, (2) endpoint network telemetry showing connections to Trezor-themed phishing domains, and (3) execution of any downloaded "Trezor software" from outside the official distribution channel. The rules and queries below target those behaviors.

Sigma Rules

---
title: Email Client Spawning Browser to Non-Standard Domain
description: Detects a web browser launched as a child of an email client process, consistent with a user clicking a link in a phishing email. Correlate with DNS/proxy telemetry for Trezor-themed lookalike domains.
id: 3f8a1c52-7b2d-4e91-a6c4-9d0e2f5b8a31
status: experimental
references:
  - https://www.bleepingcomputer.com/news/security/trezor-347-000-users-targeted-in-phishing-attacks-after-brevo-breach/
  - https://attack.mitre.org/techniques/T1566/002/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1566.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\outlook.exe'
      - '\thunderbird.exe'
      - '\msoffice.exe'
      - '\hxmail.exe'
  selection_child:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\brave.exe'
      - '\opera.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Routine user clicks on legitimate email links; this rule is a correlation pivot, not a standalone alert. Pair with domain reputation or threat intel enrichment.
level: low
---
title: DNS Query for Trezor Typosquat or Phishing Lookalike Domain
description: Detects DNS resolution attempts for domains that imitate Trezor branding but are not the official trezor.io domain. Phishing pages impersonating Trezor Suite seed-verification flows rely on lookalike domains.
id: 6b2e9d14-3c7f-4a58-b9e1-5f0c8d2a6b47
status: experimental
references:
  - https://www.bleepingcomputer.com/news/security/trezor-347-000-users-targeted-in-phishing-attacks-after-brevo-breach/
  - https://attack.mitre.org/techniques/T1566/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1566
logsource:
  category: dns
  product: windows
detection:
  selection_keywords:
    query|contains:
      - 'trezor'
      - 'trez0r'
      - 'trezorr'
      - 'trezor-' 
      - '-trezor'
      - 'trezorsuite'
      - 'trezorwallet'
  filter_legitimate:
    query|endswith:
      - 'trezor.io'
      - 'satoshilabs.com'
  condition: selection_keywords and not filter_legitimate
falsepositives:
  - Security researchers and threat intel lookups; internal documentation portals referencing the vendor.
level: high
---
title: Execution of Unsigned or Renamed Fake Trezor Suite Installer
description: Detects execution of binaries masquerading as Trezor Suite or Trezor firmware updates from user-writable directories, a common payload delivery method in wallet-targeting phishing campaigns.
id: 9c4d7a28-1e6b-4f35-8a92-2b5d0e7c3f16
status: experimental
references:
  - https://www.bleepingcomputer.com/news/security/trezor-347-000-users-targeted-in-phishing-attacks-after-brevo-breach/
  - https://attack.mitre.org/techniques/T1204/002/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_name:
    OriginalFileName|contains:
      - 'trezor'
    Image|contains:
      - '\Downloads\'
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - '\Desktop\'
      - 'C:\Users\Public\'
  filter_legitimate_path:
    Image|startswith:
      - 'C:\Program Files\Trezor'
      - 'C:\Program Files (x86)\Trezor'
  condition: selection_name and not filter_legitimate_path
falsepositives:
  - Users legitimately installing Trezor Suite from Downloads; validate installer Authenticode signature (SatoshiLabs) before dismissing.
level: high

KQL — Microsoft Sentinel / Defender

The following queries hunt the campaign across email, URL-click, and network telemetry. The first targets Defender for Office data (Safe Links click events on Trezor-themed URLs); the second hunts endpoint DNS/network connections to lookalike domains via Defender for Endpoint.

// Hunt 1: URL clicks on Trezor-themed lookalike domains (Defender for Office / Safe Links)
// Excludes official Trezor infrastructure; surfaces clicked phishing links like those in the Brevo-driven campaign.
let LookalikePattern = @"trez0r|trezorr|trezor-|trezorsuite|trezorwallet|-trezor|trezor[a-z0-9-]*\.(?!io\b)";
UrlClickEvents
| where TimeGenerated > ago(14d)
| where Url has_any ("trezor", "trez0r", "trezorr")
    and Url !has "trezor.io"
    and Url !has "satoshilabs.com"
| extend Domain = tostring(parse_url(Url).Host)
| summarize Clicks = count(), DistinctUsers = dcount(AccountUpn), FirstClick = min(TimeGenerated), LastClick = max(TimeGenerated) by Domain, ActionType
| order by Clicks desc;

// Hunt 2: Endpoint connections to Trezor lookalike domains (Defender for Endpoint)
// Joins DNS and network events to find hosts that resolved and connected to suspected phishing infrastructure.
let SuspectDomains = DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where RemoteUrl has_any ("trezor", "trez0r", "trezorr", "trezorsuite")
    and RemoteUrl !endswith "trezor.io"
    and RemoteUrl !endswith "satoshilabs.com"
| summarize Connections = count(), RemoteIPs = make_set(RemoteIP), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by DeviceName, RemoteUrl, InitiatingProcessFileName
| order by Connections desc;
SuspectDomains;

// Hunt 3: Email ingestion view — inbound Trezor-impersonation mail (if EmailEvents is available)
EmailEvents
| where TimeGenerated > ago(14d)
| where Subject has_any ("trezor", "wallet", "firmware", "seed", "recovery phrase")
    and SenderFromDomain !has "trezor.io"
    and (Subject has "trezor" or BodyPreview has "trezor")
| project TimeGenerated, SenderFromAddress, SenderFromDomain, RecipientEmailAddress, Subject, ThreatTypes, DeliveryAction
| order by TimeGenerated desc

Velociraptor VQL

Use this artifact to sweep endpoints for two forensic artifacts simultaneously: (1) DNS client cache entries referencing Trezor lookalike domains (evidence a user resolved a phishing domain even if browsing history was cleared), and (2) execution of Trezor-branded binaries from non-standard paths (evidence of a fake Suite installer).

-- Hunt: Trezor phishing campaign endpoint artifacts
-- Combines DNS cache inspection and suspicious process execution

-- Part A: Parse DNS client cache for Trezor-themed domains
SELECT Name as DnsEntry, Data as ResolvedIP, 'DNS Cache' as ArtifactSource
FROM Artifact.Windows.System.DNSCache()
WHERE DnsEntry =~ '(?i)trez0r|trezorr|trezor-|trezorsuite|trezorwallet|-trezor'
  AND DnsEntry !~ '(?i)trezor\.io$|satoshilabs\.com$'

-- Part B: Live or recently terminated Trezor-branded processes outside install dir
-- Run as a separate artifact or union with above in a notebook cell:
-- SELECT Pid, Name, Exe, CommandLine, Username, CreateTime
-- FROM pslist()
-- WHERE Name =~ '(?i)trezor'
--   AND Exe !~ '(?i)Program Files'

Remediation / Verification Script

For Windows fleets, this PowerShell script: (1) enumerates DNS client cache for Trezor lookalike entries (evidence of phishing site visits), (2) checks for Trezor-branded executables outside official install paths, and (3) optionally adds Defender Network Protection block indicators for confirmed phishing domains you supply. Run elevated.

# Trezor Phishing Campaign - Endpoint Verification and Hardening
# Security Arsenal | Run as Administrator

# --- Step 1: Check DNS client cache for Trezor lookalike domains ---
Write-Host "[*] Checking DNS cache for Trezor-themed lookalike domains..." -ForegroundColor Cyan
$suspectDns = Get-DnsClientCache | Where-Object {
    $_.Entry -match '(?i)trez0r|trezorr|trezor-|trezorsuite|trezorwallet|-trezor' -and
    $_.Entry -notmatch '(?i)^trezor\.io|satoshilabs\.com'
}
if ($suspectDns) {
    Write-Host "[!] ALERT: Suspect DNS entries found — possible phishing site visits:" -ForegroundColor Red
    $suspectDns | Format-Table Entry, Data, TimeToLive -AutoSize
    $suspectDns | Export-Csv -Path ".\TrezorPhish_DNSCache_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv" -NoTypeInformation
} else {
    Write-Host "[+] No suspect Trezor DNS cache entries found." -ForegroundColor Green
}

# --- Step 2: Hunt for fake Trezor Suite executables outside official paths ---
Write-Host "`n[*] Scanning user-writable paths for Trezor-branded executables..." -ForegroundColor Cyan
$searchPaths = @("$env:USERPROFILE\Downloads", "$env:TEMP", "$env:APPDATA", "$env:USERPROFILE\Desktop", "C:\Users\Public")
$fakeInstallers = foreach ($p in $searchPaths) {
    if (Test-Path $p) {
        Get-ChildItem -Path $p -Recurse -Include "*trezor*.exe","*trezor*.msi","*trezor*.zip" -ErrorAction SilentlyContinue |
            Where-Object { $_.FullName -notmatch 'Program Files' }
    }
}
if ($fakeInstallers) {
    Write-Host "[!] ALERT: Potential fake/unsigned Trezor installers located:" -ForegroundColor Red
    foreach ($f in $fakeInstallers) {
        $sig = Get-AuthenticodeSignature -FilePath $f.FullName
        [PSCustomObject]@{
            Path      = $f.FullName
            SizeKB    = [math]::Round($f.Length/1KB,2)
            Signed    = $sig.Status
            Signer    = $sig.SignerCertificate.Subject
            SHA256    = (Get-FileHash $f.FullName -Algorithm SHA256).Hash
        }
    } | Format-List
    Write-Host "[!] Legitimate Trezor Suite is signed by SatoshiLabs. Anything unsigned or differently signed must be treated as hostile." -ForegroundColor Yellow
} else {
    Write-Host "[+] No Trezor-branded files in user-writable paths." -ForegroundColor Green
}

# --- Step 3: (Optional) Add confirmed phishing domains to hosts block + verify Defender Network Protection ---
# Populate with domains confirmed by your IR/threat intel team before running:
$blockDomains = @()  # e.g. @("trezor-verify.example.com", "trezorsuite-login.example.net")
if ($blockDomains.Count -gt 0) {
    $hostsPath = "$env:SystemRoot\System32\drivers\etc\hosts"
    foreach ($d in $blockDomains) {
        Add-Content -Path $hostsPath -Value "0.0.0.0`t$d"
        Write-Host "[+] Blocked $d via hosts file." -ForegroundColor Green
    }
}
Write-Host "`n[*] Verifying Microsoft Defender Network Protection (blocks known-bad domains at network layer)..." -ForegroundColor Cyan
$np = Get-MpPreference | Select-Object -ExpandProperty EnableNetworkProtection
if ($np -eq 1) { Write-Host "[+] Network Protection: ENABLED" -ForegroundColor Green }
else {
    Write-Host "[!] Network Protection not enabled. Enabling now..." -ForegroundColor Yellow
    Set-MpPreference -EnableNetworkProtection Enabled
    Write-Host "[+] Network Protection enabled." -ForegroundColor Green
}
Write-Host "`n[*] Verification complete. Review any ALERT items above with your IR team." -ForegroundColor Cyan

Remediation

There is no vendor patch for this incident — the vulnerability is human trust amplified by a third-party data leak. Remediation is layered:

For Individual Trezor Users (and Employees Who Hold Crypto)

1. Never enter your recovery seed into any website, app, or "verification flow." Trezor — and every legitimate hardware wallet vendor — will never ask for your seed phrase via email, web form, or software prompt. Any page that asks is a phishing page, full stop.
2. Verify software sources. Trezor Suite should only be obtained from the official Trezor website (trezor.io) or the official app store listing, and installers must carry a valid SatoshiLabs digital signature. If the 2,500 users who clicked downloaded anything, they should assume compromise.
3. If you entered your seed on any linked page: immediately move funds to a new wallet with a freshly generated seed on the hardware device itself. Do not reuse the old seed. Time matters — attackers drain wallets within minutes.
4. If you downloaded a fake "Trezor Suite" or "firmware update": treat the machine as compromised. Run endpoint detection scans, check for persistence (run keys, scheduled tasks), and consider reimaging if the device held wallet software or exchange sessions.
5. Enable a passphrase (25th word) on the hardware wallet. Even a harvested seed is useless against a strong BIP-39 passphrase the attacker doesn't have.

For Security Teams / Enterprises

1. Email security controls: Add detections for Trezor-impersonation themes in your email gateway (subject/body keywords: "Trezor", "recovery phrase", "firmware update required", "verify your wallet") combined with sender-domain authentication failures. Enforce DMARC-reject awareness: trezor.io publishes DMARC — messages failing alignment claiming to be Trezor should be quarantined, not delivered.
2. Block lookalike domains: Feed confirmed phishing domains (from Trezor's advisories and your threat intel) into DNS filtering (Protective DNS, Cisco Umbrella, Defender Network Protection, Pi-hole for smaller orgs). Newly-registered-domain (NRD) blocking catches these campaigns early — phishing pages for bursts like this are typically hosted on domains registered days prior.
3. Browser isolation / URL rewriting: For high-risk users (executives, finance, known crypto holders), route URL clicks through isolation or Safe Links-style detonation.
4. Third-party risk management: Audit which marketing/CRM/SaaS vendors (Brevo, Mailchimp, SendGrid, etc.) hold your customer or employee contact data. Enforce data minimization: vendors should hold the minimum dataset needed. Contractually require breach notification SLAs measured in hours, not weeks. This incident demonstrates that a marketing platform breach becomes your phishing crisis within days.
5. Awareness push — now, targeted: Issue an internal advisory referencing this specific campaign. Employees who are Trezor customers are in the 347K target list. Generic annual phishing training won't land; a timely, specific warning will.
6. Monitor for follow-on waves: Breached contact lists get resold and reused. Expect this list to fuel future campaigns impersonating wallet firmware updates, "security incident" notifications, and even fake class-action or compensation lures tied to this very breach.

Vendor References

• Trezor official communications: monitor announcements on trezor.io and Trezor's official social channels for campaign-specific phishing domain indicators.
• Brevo breach details: monitor Brevo's official status and security notices for the scope of the data exposure affecting your organization if you are also a Brevo customer.

The Bottom Line

347,000 targets and 2,500 confirmed clicks in days is a reminder that the most effective phishing doesn't exploit software — it exploits context. A verified customer list from a trusted vendor relationship is worth more to an attacker than most zero-days. Your detections need to follow the user (email clicks, DNS, endpoint execution) rather than the malware, because in seed-phrase harvesting there often is no malware at all — just a convincing form and an irreversible transaction. Close the loop: hunt for the click, harden the inbox, minimize what your vendors hold, and make sure your people know that no legitimate wallet provider will ever ask for the words that guard their keys.

Related Resources

Security Arsenal Incident Response Services AlertMonitor Platform Book a SOC Assessment incident-response Intel Hub