Brevo Compromised via SAML SSO Vulnerability, Triggering Supply-Chain Phishing Across Client Subscriber Lists
Attackers exploited a SAML SSO authorization loophole in Brevo to breach 138 accounts and dispatch legitimate-looking phishing blasts to subscriber databases, including 347,000 Trezor contacts. For email marketers, this exposes the danger of supply-chain attacks that effortlessly clear SPF and DKIM checks, devastating domain trust and sender reputation.
- SAML SSO scoping failures enabled lateral cross-account takeover across 138 Brevo enterprise accounts.
- Attacking via genuine ESP infrastructure guarantees high inboxing by sailing straight past SPF, DKIM, and DMARC defenses.
- Mass phishing blasts sent directly from your own domain cause swift, lingering sender reputation damage.
- Email security posture extends to provider infrastructure; vendor isolation controls are mission-critical.
What changed
According to reporting from SecurityWeek, threat actors manipulated a configuration flaw within email service provider Brevo's SAML Single Sign-On implementation. By establishing a malicious Brevo account with SSO activated and inviting verified users, attackers leveraged an access-scoping vulnerability to cross account boundaries and authenticate as those individuals across 138 customer accounts.
Brevo disclosed that the hackers exfiltrated contact databases from 43 organizations and actively deployed phishing campaigns across six accounts. Among the hardest-hit victims was crypto hardware wallet maker Trezor, which saw roughly 347,000 newsletter contacts targeted with fake security warnings sent directly from authentic sending pipes. Other platforms including BitBox and CoinTracking experienced related fallout before Brevo terminated the vector and revoked active sessions.
Why it matters for email marketers
This incident exposes a fundamental deliverability blind spot. Because these phishing blasts originated from configured ESP nodes and carried authentic DKIM, SPF, and DMARC alignments, anti-spam heuristics waved them directly into primary inboxes. The downstream consequence of having several hundred thousand subscribers receive malicious credential-harvesting emails under your brand is catastrophic: rapid spam complaints, plummeting Google Postmaster domain reputation, and an immediate drop in deliverability for all subsequent routine and revenue-critical messages.
Beyond inbox placement, list health and audience trust take massive collateral hits. Unsubscribe spikes will surge, brand equity evaporates overnight, and transactional engagement suffers because your subscribers can no longer trust authentic system updates. Email marketing teams must confront the reality that rigorous client-side security is futile if their vendor's multi-tenant architecture permits lateral privilege escalation across distinct business accounts.
What to do about it
- 1Audit ESP administrative privileges and revoke stale multi-account access or shared agency logins that span across multiple organizational workspaces.
- 2Inspect outgoing campaign logs, automated trigger queues, and API key generation activity in Brevo or your active ESP to verify no rogue sending instances exist.
- 3Formulate an emergency incident response runbook specifically for sending-domain takedowns, including prepared subscriber alerts and registrar-level DNS fail-safes.
- 4Demand enterprise security documentation and penetration test attestations regarding SAML SSO multi-tenant scoping and tenant isolation from all email SaaS vendors.
Who this affects: Email marketing directors, CRM administrators, and deliverability specialists managing enterprise ESP instances or handling high-value, phishing-sensitive audience lists.
Original reporting by SecurityWeek. The analysis above is EmailVersed's own.
More email industry analysis on Email News, or ask the community on Q&A.