Trezor Warns of Email Provider Breach Used in Targeted Phishing Campaign Against Hardware Wallet Users
Trezor has alerted customers that attackers gained access to an external email provider used for official communications and used the foothold to launch a phishing campaign impersonating the hardware wallet maker.
The malicious messages arrived with the subject Critical Security Alert: STM32 Entropy Vulnerability and claimed, without evidence, that a flaw in STM32 microcontrollers reduced entropy and enabled reconstruction of wallet seed phrases. No published CVE matches the described issue.
The emails directed recipients to click links that led to attacker-controlled sites designed to harvest seed phrases. Trezor stated that the domain used in the campaign has already been deactivated while the company investigates how the provider was breached and why the messages achieved such a high degree of legitimacy.
Security researchers have noted that comparable phishing attempts may also have reached users of BitBox, raising the possibility that multiple hardware wallet vendors share affected service providers.
Trezor reiterated that it will never request a seed phrase via email or through any web link. Users are advised not to click unsolicited links, to verify alerts only through official channels, and to treat any entered credentials as compromised.
Related articles
SPF, DKIM and DMARC: Practical Guide to Detecting Email Spoofing and Phishing
The article explains how email authentication mechanisms SPF, DKIM, and DMARC work together to combat spoofed messages that impersonate trusted services. It provides concrete DNS record examples and shows how to interpret Authentication-Results headers in received emails. SPF verifies authorized sending IP addresses but does not check the visible From address. DKIM adds cryptographic signatures to message content and headers, while DMARC ties these checks to the sender domain visible to users and defines handling policies. The guide also covers common configuration errors, forwarding issues, and why successful authentication does not guarantee message safety. It concludes that these protocols must be combined with additional security measures such as attachment scanning and user awareness training.
JPAAWG 9th General Meeting to Examine AI-Driven Messaging Threats and Global Standards in Tokyo
The Japan Anti-Abuse Working Group will hold its ninth annual General Meeting on November 5-6, 2026, in Tokyo as a hybrid event focused on evolving messaging security challenges. Keynote speaker Tom Bartel from M3AAWG will address worldwide anti-abuse trends and the practical realities of AI-powered attacks and defenses. Sessions will cover the recently standardized DMARCbis specification under RFC 9989, ongoing work on DKIM2 to counter replay attacks, BIMI logo display adoption, and sender guidelines for AI-generated email summaries. Practical workshops will teach DMARC report analysis using real sample data along with related technologies such as ARC, DNSSEC, and MTA-STS. Government agencies including the National Police Agency and Ministry of Internal Affairs and Communications will also present, alongside a dedicated track on post-quantum cryptography.
Cybercriminals Use Fake WatchGuard VPN Support Site to Steal Credentials Through SEO Poisoning
Cybercriminals created a counterfeit WatchGuard support website that tricked users into entering their VPN server address, username, and password before delivering the legitimate installer. The Huntress team discovered the phishing page while investigating an October 7 incident at a managed service provider. Victims reached the site through Bing search results for terms such as watchguard vpn sll download, which redirected them to the malicious domain watchguard-vpn.net. The page mimicked the official support structure, including FAQs and a download button that led to a credential-harvesting form. The first submission always failed with an Incorrect data message, prompting victims to re-enter their details, after which the real signed client WG-MVPN-SSL_12_11_5.exe was provided. A 150-line JavaScript script silently exfiltrated the credentials via HTTP POST to a secondary domain, leaving no visible signs of compromise on the victim's system. The site, which claimed to be an independent fan site, was taken offline on October 13.
AI-Powered Drainer Scams Target IT Job Seekers via Malicious Repositories and Fake Recruiters
IT hiring has become a fertile ground for drainer scams that trick candidates into running malicious code under the guise of technical interviews. Scammers pose as recruiters on job platforms, offering roles that require downloading projects from private repositories or installing browser extensions for supposed corporate tools. These attacks often lead to crypto wallet drainers stealing funds, with victims reporting losses around $2000 in documented cases. AI tools are heavily used by attackers to generate realistic job postings, LinkedIn profiles, deepfake videos for calls, and obfuscated malicious code hidden in test assignments. Candidates are advised to inspect package.json, lock files, and CI/CD configurations before any execution and to use AI assistants like Claude for static analysis without running the code. The trend has grown amid mass layoffs and economic uncertainty, turning desperate job searches into opportunities for financial theft.