Compass Investments

Trezor users became the target of an extremely realistic phishing attack after attackers hacked a third-party email provider used by the hardware wallet manufacturer.

Late Wednesday, the company confirmed that users had received a fraudulent email with the subject line Critical Security Alert: STM32 Entropy Vulnerability.

Price Analysis for XRP, Stellar (XLM), Dogecoin (DOGE), and Near Protocol (NEAR) as of September 10: Can the Market Resume Its Uptrend?

Trezor also reported that it had blocked the compromised domain and is investigating how the attackers were able to gain access to the infrastructure associated with the legitimate domain.

The company did not disclose exactly how many customers received this phishing message. LINE_BREAK The incident is particularly alarming because it does not involve addresses with typos or obviously suspicious addresses.

Essentially, the malicious emails were sent through infrastructure authorized to send emails on behalf of Trezor. This makes them much harder to detect by both users and automated spam protection systems.

A screenshot that circulated after the attack shows that the email listed Trezor Security as the sender, with the address help@trezor.io.

More importantly, Gmail displayed the lines mailed-by: mailing.trezor.io and signed-by: trezor.io.

The fraudulent messages passed SPF, DKIM, and DMARC checks. This explains why recipients could see signed-by: trezor.io in Gmail and why such messages were less likely to end up in spam.

Its really serious. The phishing email is written quite convincingly and comes from Trezors official domain.

The attackers sought to create a sense of urgency by claiming that Trezor devices had a critical vulnerability related to entropy (a breach in the randomness of number generation). They tried to capitalize on the panic caused by the nightmare that befell Coldcard wallet owners earlier this year.

The unsuspecting recipients were then urged to complete a procedure that appeared to be a security check.

One user on the Trezor forum reported that an offline HTML file could have transmitted the entered information to Telegram.

Other suspicious emails targeting customers of BitBox and the cryptocurrency wallet management service CoinTracking were also reported.

Some researchers in the community pointed to the digital marketing service provider Brevo as the common infrastructure behind these incidents.”,”detected_source_language”:”RU