Trezor warns users of email provider breach, phishing attacks
Source Bleeping Computer
Description
Trezor warned customers that threat actors who breached its third-party email provider are conducting phishing attacks targeting its users. The phishing emails impersonate Trezor and claim a critical hardware vulnerability, attempting to trick recipients into clicking malicious links. Trezor has taken down the fraudulent domain and is investigating the breach. This incident follows a prior data breach involving Trezor's shipping provider ShipMonk, which exposed customer order data affecting tens of thousands of users across multiple countries. The phishing attack leverages compromised email infrastructure rather than a direct vulnerability in Trezor products.
Impact
The phishing emails pose a risk of credential theft or further compromise if users click on malicious links. While no direct compromise of Trezor hardware wallets has been reported, the breach of the email provider and prior data breaches expose customer contact information, increasing the risk of targeted social engineering attacks. The incident undermines customer trust and may lead to financial or identity theft if phishing attempts succeed.
Defensive guidance
Trezor has taken down the phishing domain and is investigating the breach. Customers are advised not to click on any links in the phishing emails and to treat any unexpected security alerts with caution. No direct vulnerability in Trezor hardware has been confirmed. Users should verify communications through official Trezor channels. Since the breach involves a third-party email provider, remediation is managed by Trezor and their providers. Monitoring for suspicious emails and educating users about phishing risks remain important.
Summary
Threat actors breached a third-party email provider used by Trezor and sent phishing emails to Trezor customers. These emails falsely claim a hardware microcontroller vulnerability in Trezor wallets to lure users into clicking malicious links. Trezor has disabled the phishing domain and is investigating how the attackers accessed their legitimate domain. This phishing campaign is related to a broader context of data breaches affecting Trezor customers, including a significant breach of ShipMonk, Trezor's shipping and logistics provider, which was exploited via a critical SQL injection zero-day in the Metabase analytics platform. The attackers used stolen customer data to facilitate targeted phishing attempts.