Trezor Says Third-Party Email Provider Breach Triggered Phishing Alert

Trezor said attackers breached its third-party email provider and sent customers a phishing email posing as a critical chip security alert, its third vendor failure in four weeks. According to BeInCrypto, the company took down the domain behind the campaign and is investigating how attackers reached its legitimate domain; it said wallets, keys and recovery backups were not exposed. The fake email referenced an “STM32 Entropy Vulnerability,” while Trezor warned users not to click links or enter recovery phrases.