Trezor has alerted customers that attackers gained access to an external email provider used for official communications and used the foothold to launch a phishing campaign impersonating the hardware wallet maker.
The malicious messages arrived with the subject Critical Security Alert: STM32 Entropy Vulnerability and claimed, without evidence, that a flaw in STM32 microcontrollers reduced entropy and enabled reconstruction of wallet seed phrases. No published CVE matches the described issue.
The emails directed recipients to click links that led to attacker-controlled sites designed to harvest seed phrases. Trezor stated that the domain used in the campaign has already been deactivated while the company investigates how the provider was breached and why the messages achieved such a high degree of legitimacy.
Security researchers have noted that comparable phishing attempts may also have reached users of BitBox, raising the possibility that multiple hardware wallet vendors share affected service providers.
Trezor reiterated that it will never request a seed phrase via email or through any web link. Users are advised not to click unsolicited links, to verify alerts only through official channels, and to treat any entered credentials as compromised.
