On September 9, attackers compromised a third-party email service provider used by Trezor. Users received phishing emails titled 'Critical Security Alert: STM32 Entropy Vulnerability,' which claimed that one in four devices had a factory defect in the random number generator.
The fraudulent messages prompted recipients to click a link to verify their device status. According to user reports, the emails passed Gmail authentication checks, including DKIM, SPF, and DMARC protocols. Trezor has since disabled the domain used in the attack and is currently investigating the breach.
The incident also affected BitBox and several other Bitcoin-related companies, suggesting a common vulnerability among the providers they utilize. BitBox confirmed the attack and stated that they have contacted their service provider to report the malicious domains.
Trezor has not disclosed the name of the affected email provider or the total number of recipients targeted in the campaign. This follows a previous security incident in August involving a breach at the logistics firm ShipMonk, which impacted over 80,000 Trezor customers.
