Trezor has disclosed that threat actors breached its third-party email service provider and are weaponizing stolen customer contact data in targeted social engineering campaigns against hardware wallet owners. This is not a theoretical risk: when an attacker holds a validated list of known cryptocurrency wallet users, every phishing email lands with pre-built credibility. The target list itself is the exploit.
For defenders, this incident sits squarely in the supply-chain / third-party risk category that keeps showing up in our IR engagements. The perimeter wasn't Trezor's infrastructure — it was a marketing SaaS platform holding customer email addresses. The downstream effect is highly targeted spear phishing aimed at extracting the one secret that matters in self-custody crypto: the recovery seed phrase. There is no patch for this. There is no CVE. The remediation is user education, mail flow defense, and endpoint detection tuned for the post-click phase of these campaigns.
If your organization has employees who hold corporate or treasury crypto assets on Trezor devices — and many do, often undisclosed to security teams — treat this as an active threat to your organization, not a consumer-only problem.
Technical Analysis
What Happened
Trezor warned customers that attackers compromised its third-party email provider and are using the access — and the customer data behind it — to conduct social engineering attacks. Based on the established playbook for this class of incident (and Trezor's own history with a near-identical MailerLite compromise), the attack chain looks like this:
- Third-party compromise. Attackers gain access to the email marketing/transactional email platform used by the vendor. This yields customer email addresses and, critically, the ability to send from the platform's legitimate, reputation-clean sending infrastructure — passing SPF, DKIM, and DMARC.
- Target list exploitation. Recipients are known hardware wallet owners. Open rates and engagement are far higher than spray-and-pray phishing because the targeting is pre-validated.
- Social engineering lure. Typical lures include fake security alerts ("your device has been compromised"), fake firmware update notifications, or fake "data breach" warnings urging users to "verify" or "re-secure" their wallet.
- Harvesting infrastructure. Links lead to lookalike domains — frequently punycode/IDN homoglyph domains (e.g.,
xn--prefixed domains visually mimickingtrezor.ioorsuite.trezor.io) — hosting pixel-perfect clones of the Trezor Suite interface. - Seed phrase capture. The clone site prompts the victim to enter their 12/24-word recovery seed, often under the guise of "verification" or "recovery check." The moment the seed is entered, funds are drained — typically within minutes via automated scripts.
Some variants of these campaigns also deliver malware: fake "Trezor Suite" installers carrying clipper malware (clipboard hijackers that swap cryptocurrency addresses) or infostealers targeting browser-stored credentials and wallet files.
Affected Parties
- Trezor customers whose email addresses were held by the compromised provider
- Any organization whose employees manage crypto assets (corporate treasuries, crypto-native firms, executives with personal holdings)
- Users of the Trezor Suite desktop/web application who may be directed to malicious clones
Exploitation Status
- Confirmed active: Social engineering emails are being sent to real customers now. This is an in-the-wild campaign, not a theoretical exposure.
- No CVE / no CISA KEV entry: This is a third-party data breach and phishing campaign, not a software vulnerability. There is nothing to patch on the Trezor device itself; the attack targets the human layer.
- Attribution: Unattributed at time of disclosure, but the TTPs match financially motivated crypto-theft crews that have historically targeted wallet vendor mailing lists.
Why Email Authentication Won't Save You
A critical defensive nuance: if attackers are sending from the compromised provider's actual infrastructure, messages will carry valid SPF/DKIM/DMARC alignment for a legitimate sending service. Gateway rules keyed solely on authentication results will pass these messages. Detection must rely on content analysis, URL rewriting/sandboxing, lookalike-domain detection, and post-delivery user reporting.
Detection & Response
The detections below focus on the observable, high-fidelity phases of this campaign: lookalike-domain resolution, post-click payload execution, and fake wallet software staging. I've deliberately avoided rules that fire on generic phishing keywords — those are noise generators your analysts will disable within a week.
Sigma Rules
YAML
---
title: DNS Query to Trezor Lookalike or IDN Homoglyph Domain
id: 3f8a2c91-7b4e-4d5a-9c1e-2a6b8d0f4e21
status: experimental
description: Detects DNS resolution attempts for punycode/IDN domains and common typosquat patterns impersonating Trezor, consistent with phishing campaigns targeting hardware wallet users following third-party email provider breaches.
references:
- https://www.bleepingcomputer.com/news/security/trezor-warns-users-of-email-provider-breach-phishing-attacks/
- https://attack.mitre.org/techniques/T1566/002/
- https://attack.mitre.org/techniques/T1071/001/
author: Security Arsenal
date: 2026/01/14
tags:
- attack.initial_access
- attack.t1566.002
- attack.t1656
logsource:
category: dns
product: windows
detection:
selection_punycode:
query|contains:
- 'xn--'
selection_trezor_lookalike:
query|contains:
- 'trezor'
- 'trez0r'
- 'trezorr'
- 'trrezor'
- 'trezor-suite'
- 'trezorsuite'
- 'suite-trezor'
- 'trezor-wallet'
- 'trezor-support'
- 'trezor-login'
- 'trezor-verify'
- 'trezor-recovery'
filter_legitimate:
query|endswith:
- 'trezor.io'
- 'satoshilabs.com'
condition: (selection_punycode and selection_trezor_lookalike) or (selection_trezor_lookalike and not filter_legitimate)
falsepositives:
- Security research or brand-protection scanning
- Marketing or SEO tooling monitoring brand mentions
level: high
---
title: Browser Process Spawning Command Interpreter After Phishing Click
id: 8c1d5e72-4a9b-4f3c-b2d7-6e0a9f1c3d45
status: experimental
description: Detects web browsers spawning cmd, PowerShell, wscript, mshta, or rundll32 child processes — a strong post-exploitation signal when users are lured to malicious sites delivering fake wallet installers or script-based payloads, as seen in campaigns targeting Trezor users.
references:
- https://www.bleepingcomputer.com/news/security/trezor-warns-users-of-email-provider-breach-phishing-attacks/
- https://attack.mitre.org/techniques/T1059/
- https://attack.mitre.org/techniques/T1204/002/
author: Security Arsenal
date: 2026/01/14
tags:
- attack.execution
- attack.t1059
- attack.t1204.002
logsource:
category: process_creation
product: windows
detection:
selection_parent_browser:
ParentImage|endswith:
- '\chrome.exe'
- '\msedge.exe'
- '\firefox.exe'
- '\brave.exe'
- '\opera.exe'
selection_child:
Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
- '\pwsh.exe'
- '\wscript.exe'
- '\cscript.exe'
- '\mshta.exe'
- '\rundll32.exe'
- '\msiexec.exe'
filter_extension_helper:
CommandLine|contains:
- '--type='
- 'extension'
condition: selection_parent_browser and selection_child and not filter_extension_helper
falsepositives:
- Rare browser-integrated enterprise tooling
- Legitimate software update flows initiated from browser downloads (usually msiexec — review parent/child pairs before tuning)
level: high
---
title: Execution of Suspected Fake Trezor Suite Installer from User-Writable Path
id: 5b7e3a19-2d8f-4c6a-a1b3-9f4e7d2c8b56
status: experimental
description: Detects execution of binaries referencing Trezor branding from user-writable directories (Downloads, Temp, AppData) rather than the legitimate Program Files installation path, consistent with trojanized wallet software delivered via phishing after vendor mailing-list breaches.
references:
- https://www.bleepingcomputer.com/news/security/trezor-warns-users-of-email-provider-breach-phishing-attacks/
- https://attack.mitre.org/techniques/T1204/002/
- https://attack.mitre.org/techniques/T1036/
author: Security Arsenal
date: 2026/01/14
tags:
- attack.execution
- attack.t1204.002
- attack.t1036
logsource:
category: process_creation
product: windows
detection:
selection_name:
Image|contains:
- 'trezor'
- 'Trezor'
selection_path:
Image|contains:
- '\Downloads\'
- '\Temp\'
- '\AppData\Local\Temp\'
- '\AppData\Roaming\'
- '\Public\'
- '\Desktop\'
filter_legitimate:
Image|startswith:
- 'C:\Program Files\Trezor Suite\'
- 'C:\Program Files (x86)\Trezor Suite\'
condition: selection_name and selection_path and not filter_legitimate
falsepositives:
- Users legitimately running the Trezor Suite installer from Downloads before installation completes — validate digital signature (should be signed by SatoshiLabs) before escalating to full IR
level: high
KQL — Microsoft Sentinel / Defender
This hunt combines mail flow visibility (Defender for Office 365 EmailEvents / EmailUrlInfo) with endpoint network telemetry to catch both the delivery and the click. Tune the domain list against your own threat intel feeds as lookalike domains are identified.
KQL — Microsoft Sentinel / Defender
// Hunt: Trezor-themed phishing delivery and click-through activity
// Covers: email delivery referencing Trezor, URL clicks, and DNS/network connections to lookalike domains
let lookalikePatterns = dynamic(["trez0r","trezorr","trrezor","trezor-suite","trezorsuite","suite-trezor","trezor-wallet","trezor-support","trezor-login","trezor-verify","trezor-recovery","xn--"]);
let legitDomains = dynamic(["trezor.io","satoshilabs.com"]);
// Stage 1: Inbound mail referencing Trezor from non-Trezor senders (possible campaign from compromised ESP)
let SuspiciousMail = EmailEvents
| where Timestamp > ago(14d)
| where Subject has_any ("trezor","wallet","recovery seed","firmware") or SenderDisplayName has "trezor"
| where SenderFromDomain !in~ (legitDomains)
| project EmailTime=Timestamp, NetworkMessageId, Subject, SenderFromAddress, SenderFromDomain, RecipientEmailAddress, DeliveryAction, ThreatTypes;
// Stage 2: URLs in those messages
let PhishUrls = EmailUrlInfo
| where Timestamp > ago(14d)
| join kind=inner SuspiciousMail on NetworkMessageId
| project Url, UrlDomain, RecipientEmailAddress, Subject, SenderFromDomain;
// Stage 3: Endpoint connections to lookalike or punycode domains mentioning trezor
let EndpointHits = DeviceNetworkEvents
| where Timestamp > ago(14d)
| where RemoteUrl has_any (lookalikePatterns) and RemoteUrl has "trezor" or (RemoteUrl startswith "xn--" or RemoteUrl contains ".xn--")
| where not(RemoteUrl has_any (legitDomains))
| project ClickTime=Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP;
union PhishUrls, EndpointHits
| sort by EmailTime desc
KQL — Microsoft Sentinel / Defender
// Hunt: Execution of unsigned/trojanized Trezor-branded binaries outside legitimate install paths
DeviceProcessEvents
| where Timestamp > ago(14d)
| where FileName has "trezor" or ProcessCommandLine has "trezor"
| where FolderPath !startswith "C:\\Program Files\\Trezor Suite"
and FolderPath !startswith "C:\\Program Files (x86)\\Trezor Suite"
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, SHA256, InitiatingProcessFileName
| join kind=leftouter (DeviceFileCertificateInfo | project SHA256, IsSigned, Signer) on SHA256
| where IsSigned == 0 or Signer !has "SatoshiLabs"
Velociraptor VQL
Use this artifact to sweep endpoints for staged fake wallet installers and Trezor-branded executables in user-writable locations — the artifacts clippers and fake-Suite droppers leave behind even after execution.
VQL — Velociraptor
-- Hunt: Trezor-branded executables staged in user-writable paths (fake wallet installer sweep)
LET hits = SELECT FullPath, Size, Mtime, Btime,
authenticode(filename=FullPath) AS Authenticode
FROM glob(globs=[
'C:/Users/*/Downloads/*trezor*',
'C:/Users/*/Desktop/*trezor*',
'C:/Users/*/AppData/Local/Temp/*trezor*',
'C:/Users/*/AppData/Roaming/*trezor*',
'C:/ProgramData/*trezor*',
'C:/Users/Public/*trezor*'
], accessor='ntfs')
WHERE NOT IsDir
SELECT FullPath, Size, Mtime,
Authenticode.Trusted AS SignatureTrusted,
Authenticode.SubjectName AS Signer
FROM hits
WHERE NOT (SignatureTrusted =~ 'trusted' AND Signer =~ 'SatoshiLabs')
ORDER BY Mtime DESC
VQL — Velociraptor
-- Hunt: Processes with Trezor in the name running from non-standard paths (live execution check)
SELECT Pid, Name, Exe, CommandLine, Username, CreateTime,
authenticode(filename=Exe) AS Signature
FROM pslist()
WHERE Name =~ '(?i)trezor'
AND Exe !~ '(?i)Program Files.??Trezor Suite'
Remediation & Verification Script
Run this on managed endpoints (via your RMM or Intune) to audit for trojanized wallet software, block known-bad patterns at the resolver level, and surface users who may have interacted with the campaign.
PowerShell
# Trezor Phishing Campaign - Endpoint Audit & Hardening
# Run as SYSTEM/Admin. Review output before taking destructive action.
$report = @()
# 1) Find Trezor-branded binaries outside the legitimate install path
$suspectPaths = @(
"$env:SystemDrive\Users\*\Downloads\*",
"$env:SystemDrive\Users\*\Desktop\*",
"$env:SystemDrive\Users\*\AppData\Local\Temp\*",
"$env:SystemDrive\Users\*\AppData\Roaming\*",
"$env:SystemDrive\ProgramData\*"
)
$found = Get-ChildItem -Path $suspectPaths -Filter "*trezor*" -Include *.exe,*.msi,*.bat,*.ps1,*.js,*.vbs,*.lnk -ErrorAction SilentlyContinue -Recurse
foreach ($f in $found) {
$sig = Get-AuthenticodeSignature -FilePath $f.FullName
$report += [PSCustomObject]@{
Path = $f.FullName
Modified = $f.LastWriteTime
SigStatus = $sig.Status
Signer = $sig.SignerCertificate.Subject
Verdict = if ($sig.Status -eq 'Valid' -and $sig.SignerCertificate.Subject -match 'SatoshiLabs') { 'Likely Legitimate Installer' } else { 'SUSPICIOUS - Isolate host and triage' }
}
}
$report | Format-List
# 2) Check installed Trezor Suite integrity
$suite = Get-Item "C:\Program Files\Trezor Suite\Trezor Suite.exe" -ErrorAction SilentlyContinue
if ($suite) {
$s = Get-AuthenticodeSignature $suite.FullName
Write-Host "[+] Trezor Suite installed. Signature: $($s.Status) | Signer: $($s.SignerCertificate.Subject)"
if ($s.Status -ne 'Valid' -or $s.SignerCertificate.Subject -notmatch 'SatoshiLabs') {
Write-Host "[!] WARNING: Installed Trezor Suite is NOT validly signed by SatoshiLabs. Treat host as compromised." -ForegroundColor Red
}
} else {
Write-Host "[-] Trezor Suite not installed in default path."
}
# 3) Enable Windows Defender Network Protection & SmartScreen (blocks known phishing domains at OS level)
Set-MpPreference -EnableNetworkProtection Enabled
Set-MpPreference -PUAProtection Enabled
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" -Name "EnableSmartScreen" -Value 1 -ErrorAction SilentlyContinue
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter" -Name "EnabledV9" -Value 1 -ErrorAction SilentlyContinue
Write-Host "[+] Defender Network Protection and SmartScreen enforced."
# 4) Audit DNS cache for lookalike hits (evidence of click-through)
$dnsHits = Get-DnsClientCache | Where-Object { $_.Entry -match 'trezor|xn--' -and $_.Entry -notmatch 'trezor\.io|satoshilabs\.com' }
if ($dnsHits) {
Write-Host "[!] Suspicious DNS cache entries found - possible phishing click-through:" -ForegroundColor Red
$dnsHits | Format-Table Entry, Data, Type
} else {
Write-Host "[+] No suspicious Trezor-related DNS cache entries."
}
# 5) Export report for SIEM ingestion
$report | Export-Csv -Path "$env:ProgramData\TrezorPhishAudit_$(Get-Date -Format yyyyMMdd_HHmm).csv" -NoTypeInformation
Write-Host "[+] Report exported to $env:ProgramData"
Any host flagged SUSPICIOUS in step 1 or showing a signature failure in step 2 should be isolated immediately and treated as a potential wallet-compromise IR case — assume any seed entered on that machine is burned.
Remediation
There is no vendor patch for a third-party mailing-list breach. Remediation is layered: protect users, protect endpoints, and contain the blast radius if someone already engaged with a lure.
Immediate Actions (24 hours)
- Alert your user base — especially known crypto holders and finance/treasury staff. Communicate one non-negotiable rule: Trezor will never ask for your recovery seed. No legitimate support flow, email, website, or "security check" requires entering seed words into a computer. The seed only ever goes into the physical device during recovery.
- Block lookalike domains at the resolver. Add punycode-domain alerting (
xn--patterns combined with brand keywords) to your DNS security layer (Cisco Umbrella, Infoblox, Microsoft Defender for Endpoint network protection, etc.). Subscribe to brand-monitoring feeds for newly registered*trezor*domains and preemptively sinkhole them. - Tune the mail gateway for ESP-originated phishing. Since messages may pass SPF/DKIM/DMARC via the compromised provider's infrastructure, enable: URL rewriting with time-of-click protection, attachment sandboxing, and banner warnings on external mail matching wallet/seed/firmware keywords. Review mail flow logs for Trezor-themed subjects over the past 14 days (KQL above).
- Verify installed Trezor Suite instances are legitimate, signed by SatoshiLabs, and downloaded only from
trezor.io(script above). Remove any instance that fails signature validation.
If a User Entered Their Seed or Installed a Fake App
- Treat the seed as compromised — immediately. Move funds to a new wallet generated from a fresh seed on a device that has never been exposed. Speed matters; automated drainers operate in minutes.
- Isolate the endpoint and image it for forensics. Fake Suite installers frequently bundle clippers and infostealers that persist after the phishing site is closed. Assume browser credentials and session tokens on that host are also compromised and rotate accordingly.
- File reports with Trezor's official support channels, the FBI IC3 (ic3.gov), and — for organizational losses — engage your IR retainer before funds move through mixers.
Strategic / Third-Party Risk
- Audit your own marketing/ESP stack. This is the lesson for your organization: inventory every third party that holds customer PII or can send email as your brand. Enforce MFA and phishing-resistant authentication on those tenants, restrict API key scope, and contractually require breach notification SLAs.
- Add mailing-list compromise to your tabletop scenarios. Your incident response plan should cover "our ESP was breached and attackers are phishing our customers from our own infrastructure" — including pre-drafted customer communications that tell users exactly what you will never ask them to do.
- Crypto asset governance. If your organization holds digital assets, mandate hardware-wallet seed handling procedures, dedicated/segmented machines for wallet operations, and prohibit seed entry into any software interface — full stop.
Vendor References
- Trezor official advisory and support: https://trezor.io/support
- BleepingComputer coverage: https://www.bleepingcomputer.com/news/security/trezor-warns-users-of-email-provider-breach-phishing-attacks/
Related Resources
Security Arsenal Incident Response Services AlertMonitor Platform Book a SOC Assessment incident-response Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.