Trezor disclosed that attackers breached its third-party email provider to send phishing emails disguised as critical security alerts about an STM32 chip vulnerability, marking the third vendor-related security incident in four weeks. A data breach at ShipMonk in August exposed over 80,000 customer records including names, phone numbers, and home addresses, following a 2024 support portal breach affecting 66,000 users. The attackers leveraged the legitimate sender domain to bypass user skepticism, while Trezor’s core infrastructure including wallets, keys, and recovery backups remained unaffected. Customers are advised to avoid clicking links in unexpected emails, never share recovery phrases, and transfer funds to a new wallet if compromised. BitBox, another hardware wallet manufacturer, also reported a similar phishing campaign targeting its newsletter subscribers.
Source: Read the original article
