Sep 9, 2026
1 new drain, 1 update.
New
-
Medium✓Contained
Brevo login flaw lets attacker email a fake Trezor 'STM32 entropy' alert to 347,000 subscribers
An attacker abused an authorization flaw in email platform Brevo to reach 138 client accounts and send phishing from six of them. One was a fake Trezor 'Critical Security Alert: STM32 Entropy Vulnerability' sent to about 347,000 Trezor newsletter subscribers, linking to an app that asked for wallet backups; BitBox's list and CoinTracking (a fake 'refresh API keys' email) were also used. Trezor took the phishing domain down within 20 minutes; about 2,500 people opened the link and no losses have been reported. Recipients should expect follow-up phishing to the same addresses.
Trezor, BitBox and CoinTracking newsletter subscribers·Bitcoin, Multiple EVM chains·Since Sep 9, 2026·
Updated
-
High✕Still active
Ongoing wave: bookmarklet drainers target logged-in Solana memecoin trading apps
Since at least late 2025, scammers have used fake tools and fake 'verification' steps to get Solana memecoin traders to drag a bookmark into their browser and click it on a trading site they are logged in to, where it takes the session or wallet data and the account is drained. Reports cover Axiom traders in December 2025 and a Fomo user who lost about $48,000 in October 2026; SlowMist called it an old method being reused. In September 2026 Socket found theft code in malicious extensions labelled as Axiom bookmarklet tooling and noted that Axiom bookmark drainers circulate publicly. Traders on any web terminal should refuse any bookmark from others, use MFA and keep trading wallets small.
Users of web-based Solana memecoin trading apps (reported: Axiom, Fomo)·Solana·Since Dec 26, 2025·