Executive Summary
Trezor, a cryptocurrency hardware wallet manufacturer, has warned customers of ongoing phishing attacks originating from a breach at their third-party email provider. The attackers are sending fraudulent 'Critical Security Alert' emails regarding a fake 'STM32 Entropy Vulnerability' to lure users into revealing sensitive seeds. This incident follows a series of supply chain compromises affecting Trezor's ecosystem, including a significant data breach at logistics provider ShipMonk.
Technically, the campaign leverages compromised legitimate domains and vulnerabilities in third-party software, notably a critical SQL injection zero-day in the Metabase analytics platform used by ShipMonk. The ShinyHunters extortion gang has been linked to these activities, specifically targeting customer data for extortion and follow-on phishing.
The impact is substantial, with over 81,000 customers in the U.S. and internationally (UK, Brazil, Colombia, Italy, Portugal, Sweden) having their personal information exposed. This campaign highlights the high risk of supply-chain pivoting where attackers compromise less-secure service providers to target high-value cryptocurrency users.