Trezor's Mailchimp newsletter used to send fake Trezor Suite

On 2–3 April 2022 subscribers to Trezor’s newsletter received emails claiming Trezor had suffered a security incident and telling them to download a new version of Trezor Suite and set a new PIN. Trezor confirmed the phishing on 3 April and said it was investigating a potential breach of its opt-in newsletter hosted on Mailchimp.

According to BleepingComputer, the download button led to a Punycode look-alike domain that displayed as suite.trezor.com. The download was a modified build of the open-source Trezor Suite, signed by “Neodym Oy” rather than SatoshiLabs; when a device was connected it asked for the recovery phrase and sent it to the attackers.

Mailchimp told TechCrunch it detected the intrusion on 26 March 2022: after a social-engineering attack, an attacker reached an internal support and account-administration tool, viewed about 300 accounts and exported audience data from 102 of them. The Block reports that Trezor took the phishing domain offline and paused its newsletter.

In its own account of 14 April 2022, Trezor states that four Mailchimp employees were phished over several weeks, that attacks took place in February (without data loss), in March and on 2 April, and that the last one appears to have targeted Trezor’s account alone. According to Trezor, the stolen data included subscriber email addresses, data of people who had unsubscribed and, in some cases, names and IP addresses. Trezor said it would stop using Mailchimp.

What Trezor advises:

• Never enter your recovery seed in any app or website; enter it only on the Trezor device.
• Type trezor.io into the browser instead of following links in emails.