Trezor warns users of phishing after email provider data breach

Hardware wallet manufacturer Trezor warns users about a phishing attack after the company’s external email provider was hacked. Through the compromised system, attackers are sending a fake security email. Trezor says it has taken the domain offline and is investigating how the attackers gained access.

In brief:

• Trezor’s external email provider has been hacked by malicious actors.
• Attackers are using the compromised system to send a fake email with the subject “Critical Security Alert: STM32 Entropy Vulnerability”.
• Trezor has taken the domain offline and is investigating how the attackers gained access.

Fake security email sent via compromised system

Trezor reports via X that the external party that handles its email traffic has been hit by a data breach. Attackers are abusing that access to send a phishing email that appears to come from Trezor itself.

The email has the subject “Critical Security Alert: STM32 Entropy Vulnerability”. Trezor makes clear that the company did not send this email and that users must not click any link in the message.

Domain offline, investigation launched

Trezor says it has already disabled the domain that was used for the attack. At the same time, an investigation is underway into how the attackers managed to gain access to the company’s legitimate domain.

WuBlockchain reports that Trezor is the second-largest hardware wallet manufacturer in the world. A phishing attack via an official-looking sender is extra dangerous, because users are less likely to recognise the email as suspicious.

Anyone who has received the email in question would be wise to delete it without clicking on links or opening attachments.