TLDR
Crypto hardware wallet maker Trezor disclosed that threat actors who breached Brevo, its third party email marketing provider, used the access to send phishing emails to roughly 347,000 newsletter subscribers. About 2,500 users clicked the...
Como funciona
Crypto hardware wallet maker Trezor disclosed that threat actors who breached Brevo, its third party email marketing provider, used the access to send phishing emails to roughly 347,000 newsletter subscribers. About 2,500 users clicked the...
Señales de alerta
- Unsolicited email demanding you type your 12/24 word recovery seed into any website or app. Trezor (and no legitimate wallet) will never ask for your seed. Sender address spoofing help@trezor.io from a marketing platform, not Trezor's own infrastructure. Urgency framing ("critical security alert") pressuring immediate action without verifying on the official site. Actions Never enter your recovery seed into a website, app, or form — treat it like a password, offline only. Verify any wallet alert directly by typing trezor.io into your browser
- ignore email links. Revoke and re derive wallet backups i
Qué hacer
- 1Trezor (and no legitimate wallet) will never ask for your seed.
- 2Urgency framing ("critical security alert") pressuring immediate action without verifying on the official site.
- 3Actions Never enter your recovery seed into a website, app, or form — treat it like a password, offline only.
Fuente
bleepingcomputer
Fuente verificada por Mythos Forensic Team
https://www.bleepingcomputer.com/news/security/trezor-347-000-users-targeted-in-phishing-attacks-after-brevo-breach/FAQ
Es Trezor phishing via Brevo breach targets 347000 crypto wallet users una estafa real?
Si. Trata el mensaje, la llamada o la solicitud de pago como sospechosos hasta que los verifiques por un canal oficial.
Cuales son las primeras senales?
Unsolicited email demanding you type your 12/24 word recovery seed into any website or app. Trezor (and no legitimate wallet) will never ask for your seed. Sender address spoofing help@trezor.io from a marketing platform, not Trezor's own infrastructure. Urgency framing ("critical security alert") pressuring immediate action without verifying on the official site. Actions Never enter your recovery seed into a website, app, or form — treat it like a password, offline only. Verify any wallet alert directly by typing trezor.io into your browser; ignore email links. Revoke and re derive wallet backups i
Que debo hacer primero?
Trezor (and no legitimate wallet) will never ask for your seed.; Urgency framing ("critical security alert") pressuring immediate action without verifying on the official site.; Actions Never enter your recovery seed into a website, app, or form — treat it like a password, offline only.
Puede LegalAudit revisar mi caso?
Si. Abre el chat gratis y pega el mensaje, el enlace, el remitente o los datos de pago para un triage.