Threat actors breached a third-party email provider used by Trezor and sent phishing emails to Trezor customers. These emails falsely claim a hardware microcontroller vulnerability in Trezor wallets to lure users into clicking malicious links. Trezor has disabled the phishing domain and is investigating how the attackers accessed their legitimate domain. This phishing campaign is related to a broader context of data breaches affecting Trezor customers, including a significant breach of ShipMonk, Trezor's shipping and logistics provider, which was exploited via a critical SQL injection zero-day in the Metabase analytics platform. The attackers used stolen customer data to facilitate targeted phishing attempts.

The phishing emails pose a risk of credential theft or further compromise if users click on malicious links. While no direct compromise of Trezor hardware wallets has been reported, the breach of the email provider and prior data breaches expose customer contact information, increasing the risk of targeted social engineering attacks. The incident undermines customer trust and may lead to financial or identity theft if phishing attempts succeed.

Trezor has taken down the phishing domain and is investigating the breach. Customers are advised not to click on any links in the phishing emails and to treat any unexpected security alerts with caution. No direct vulnerability in Trezor hardware has been confirmed. Users should verify communications through official Trezor channels. Since the breach involves a third-party email provider, remediation is managed by Trezor and their providers. Monitoring for suspicious emails and educating users about phishing risks remain important.