Loading story…
Attackers exploited a Brevo single sign-on vulnerability to access BitBox’s external email-service account, export its newsletter, affiliate, and tutorial subscriber list, and send two phishing campaigns through Brevo’s legitimate infrastructure. The emails falsely warned of a BitBox security issue and directed recipients to malicious sites intended to steal wallet recovery words. Brevo reportedly detected the attack at 06:30 UTC, blocked the access path at 08:30 UTC, and signed users out; BitBox reported the phishing domains for takedown.
BitBox said the exposed information was limited to subscriber email addresses and that shop orders, customer order data, internal systems, BitBoxApp, and BitBox hardware wallets were not compromised. Recipients who did not interact with the messages were advised to delete or report them; BitBox reiterated that recovery words must never be entered into websites, emails, support forms, or the BitBoxApp.
Get the infrastructure and lures behind it.
6 events from the most recent confirmed update back to the earliest known activity.
A second phishing campaign using the same message was stopped during delivery after reaching about half of BitBox's newsletter list.
Brevo blocked the attack route at 08:30 UTC and signed out all users. It reported no further attacker activity after the route was blocked.
Brevo identified the issue affecting its single sign-on functionality at 06:30 UTC.
BitBox notified Brevo within an hour of the phishing activity and sent a warning to its newsletter list within an hour of the first campaign. It also reported the phishing domains, which were taken down within minutes.
Using BitBox's Brevo account, attackers sent a phishing campaign to newsletter and tutorial subscribers and downloaded the full Brevo contact list, which contained subscriber email addresses. The emails falsely claimed a BitBox security issue and directed recipients to sites requesting recovery words.
Attackers abused a Brevo single sign-on flaw by creating an SSO-enabled organization and inviting existing users, allowing access across organizations those users could access. The flaw affected more than 100 independent customer accounts, including BitBox's account.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Trezor warned customers that attackers who compromised a third-party email provider are sending phishing messages from `help@trezor.io`. The emails masquerade as urgent security notices and falsely claim an STM32 microcontroller entropy flaw exposes wallet seed phrases to brute-force recovery. Trezor said its own systems were not breached, disabled the phishing domain, and is investigating the provider compromise and the attackers' use of its legitimate email domain; BitBox users were also reportedly targeted through a similar provider-related campaign. The lure exploits concern over genuine hardware-wallet entropy issues, including a Coldcard Mk3 firmware flaw reportedly linked to theft of roughly 594 BTC from about 500 addresses. Trezor customers also face heightened social-engineering risk after logistics contractor ShipMonk exposed order data for approximately 81,000 customers in a separate breach reportedly tied to a critical Metabase SQL-injection zero-day. Organizations and users should treat unsolicited wallet-security emails as malicious, avoid embedded links, and verify notices through official channels.
Sep 11, 2026
Threat actors have launched a sophisticated phishing campaign targeting users of the password managers LastPass and Bitwarden. The attackers send well-crafted emails that falsely claim LastPass or Bitwarden has suffered a security breach, urging recipients to download a new, supposedly more secure desktop version of the password manager. These emails are designed to create a sense of urgency and exploit social engineering tactics, with the goal of tricking users into downloading a malicious binary. Upon execution, the binary silently installs Syncro, a remote monitoring and management (RMM) tool commonly used by managed service providers. Once Syncro is installed, the attackers use it to deploy ScreenConnect, a remote support and access software, enabling them to further compromise the victim's system. This access allows the threat actors to deliver additional malware, steal data, and potentially compromise password vaults stored on the affected machines. The phishing emails are sent from addresses such as ‘hello@lastpasspulse[.]blog’ and ‘hello@lastpasjournal[.]blog’, and they mimic official security alerts from LastPass and Bitwarden. The messages claim that older .exe installations of the password managers are vulnerable and that users must upgrade to a new MSI installer to protect their vault data. LastPass has publicly denied any breach of its systems, clarifying that the emails are fraudulent and part of a social engineering scheme. The campaign began over a weekend, likely to take advantage of reduced staffing and slower detection during the holiday period. Bitwarden users have also been targeted with similar phishing emails, indicating a broad scope for the campaign. The attackers' use of legitimate remote access tools like Syncro and ScreenConnect makes detection and remediation more challenging for victims. The campaign follows a similar pattern to previous phishing attacks against users of other password managers, such as 1Password. Security experts warn that the use of trusted brand names and plausible security narratives increases the likelihood of user compromise. Organizations are advised to educate users about the risks of unsolicited security alerts and to verify any requests for software updates directly with the vendor. The incident highlights the ongoing threat posed by phishing campaigns that leverage trusted brands and remote access tools to gain control over user systems and sensitive data. Both LastPass and Bitwarden have issued statements to reassure users and provide guidance on identifying and avoiding these phishing attempts. The campaign demonstrates the evolving tactics of cybercriminals in targeting password manager users, who often have access to highly sensitive credentials. Security teams should monitor for unauthorized installations of RMM tools and implement controls to prevent lateral movement and data exfiltration. The incident underscores the importance of layered security defenses and user awareness training in mitigating the impact of phishing attacks.
Jul 12, 2026
Betterment confirmed a **data breach** after an attacker used access to a **third-party platform** supporting Betterment’s marketing/operations to send fraudulent crypto “reward” messages to customers. The intrusion occurred on **January 9** via a **social engineering/phishing-style attack** against the third-party service, enabling the threat actor to distribute emails that appeared to originate from Betterment infrastructure and lured recipients with a promise to “triple” cryptocurrency sent to an attacker-controlled wallet. Betterment stated the attacker accessed customer **PII** visible within the compromised system—**names, email addresses, postal addresses, phone numbers, and dates of birth**—but that **customer accounts, passwords, and login credentials were not compromised** and Betterment’s core infrastructure was not impacted. The company reported detecting the activity the same day, revoking the unauthorized access, and engaging an external cybersecurity firm to investigate; affected customers were advised to ignore the scam message (reported as sent from `support@e.betterment.com` with the subject line “We’ll triple your crypto! (Limited Time)”).
Jun 29, 2026