Trezor users face targeted phishing campaign

TLDR

Trezor hardware wallet users are being hit by a highly convincing phishing campaign that misuses a breached third-party email provider.

1. Attackers sent fake Critical Security Alert: STM32 Entropy Vulnerability emails from infrastructure authorised to mail as trezor.io, making them look like genuine security notices.
2. Current reports say Trezor devices, private keys and recovery phrases are not compromised, but exposed customer data and realistic emails create a high risk if users click links or enter seeds.
3. Users should ignore and delete these messages, never enter recovery phrases into any site or form, and verify any security alert directly via Trezors official app or website.

Deep Dive

1. How The Phishing Campaign Works

Reports describe a phishing email titled Critical Security Alert: STM32 Entropy Vulnerability that claims up to 25% of Trezor devices suffer from a serious randomness flaw and urges security verification or firmware updates via a link or file. Trezor has confirmed that this email is fraudulent and attributes it to a breach of its third-party email provider, which allowed attackers to send messages from infrastructure authorised to send on behalf of trezor.io.

Because the messages appear as Trezor Security and pass SPF, DKIM and DMARC checks, they can bypass spam filters and look indistinguishable from genuine security advisories. Some investigations report that an attached HTML file can exfiltrate entered information to an attacker controlled channel, making any entered seed or passphrase immediately dangerous.

2. What Is And Is Not Compromised

So far, Trezor and multiple security reports indicate that the breach is in external email or newsletter infrastructure, not in Trezor hardware, firmware or key storage. There is no evidence that device private keys or on device randomness have been compromised, and Trezor has stated that funds remain safe as long as users do not disclose recovery data.

However, earlier breaches at Trezors logistics partner exposed names, emails and shipping details of tens of thousands of customers, increasing the pool of verified hardware wallet owners that attackers can target with personalised phishing. Similar phishing messages have also hit other hardware wallet users, suggesting a shared provider or overlapping mailing lists.

3. How Trezor Users Can Stay Safe

1. Treat any email titled Critical Security Alert: STM32 Entropy Vulnerability or similar as malicious, even if it appears to come from trezor.io.
2. Never enter your recovery phrase, PIN or passphrase into a website, email form or attached file. Trezor and other hardware wallet vendors do not ask for seeds through email.
3. If you receive a scary security mail, independently open Trezor Suite or type the official Trezor website into your browser, and check for alerts there instead of clicking emailed links.

Conclusion

Trezor users are facing a sophisticated phishing wave that rides on a breached email provider and highly realistic fake security alerts, but available evidence indicates devices and keys remain secure if users ignore the scam. The real danger is handing over recovery data or approving actions via malicious links, so the most important response is disciplined verification of any urgent email through trusted channels you initiate yourself.