Hardware Wallet Manufacturer Trezor Warns Users About Phishing Attacks

Red Dog Security

26 Jun 2025 — 1 min read

The maker of Trezor hardware crypto wallets is warning users about phishing attacks. Hackers exploited the company’s automated support system to send out malicious messages.

The issue stems from the fact that anyone could open a support ticket on the company’s website by simply entering an arbitrary email address and a subject line. The system would then automatically send the ticket number to the provided email and use the entered subject as the email’s title.

Cybercriminals abused this feature by sending users tickets with phishing-themed subject lines. For example:
"[URGENT]: vault.trezor.guide – Set up a Trezor vault now to protect assets that may be at risk."

Since the emails came from Trezor’s official address, [email protected], they appeared legitimate to recipients. However, the subject lines contained fake warnings and links to fraudulent websites. Users who clicked the link were directed to a phishing page that asked for their wallet credentials.

Trezor devices are hardware cold wallets that operate offline and require physical confirmation to approve transactions. However, the wallets set up on Trezor devices are secured by a 24-word seed phrase, which essentially acts as the master password to all user assets. This means anyone who knows another user’s seed phrase can recreate their wallet on another device and gain full access to their cryptocurrency.

Trezor representatives remind device owners that seed phrases should never be shared under any circumstances.

The company also assured users that it is already working on implementing security measures to prevent similar abuses in the future.

352 Android Apps Infected with IconAds Adware

Security researchers at Human Security have uncovered a massive ad fraud operation dubbed IconAds, involving 352 malicious Android apps previously available on the Google Play Store. At its peak, the campaign generated over 1.2 billion ad requests per day, primarily targeting users in Brazil, Mexico, and the United States.

AI Chatbots Like ChatGPT Are Providing Fake URLs for Major Companies

Cybersecurity analysts at Netcraft have uncovered a troubling trend: AI chatbots frequently generate incorrect or misleading URLs when asked to provide official website links for major brands. According to researchers, this flaw opens a dangerous new vector for phishing and domain hijacking attacks. Key Findings from Netcraft’s Study The

Hackers Leak Allegedly Stolen Telefónica Data

A hacker is threatening to release 106 GB of data allegedly stolen from Spanish telecommunications giant Telefónica, though the company firmly denies any recent breach or data compromise. The threat actor, operating under the alias “Rey,” claims the intrusion occurred on May 30, during which over 12 hours of data

.es Domains Become 19 Times More Popular Among Phishers

Cybersecurity researchers at Cofense report a dramatic rise in phishing campaigns leveraging .es domains, which are officially reserved for Spanish-language websites or entities based in Spain. The use of these domains by cybercriminals has surged 19-fold since the beginning of 2025, making .es the third most exploited top-level domain (TLD)

Read more

352 Android Apps Infected with IconAds Adware

AI Chatbots Like ChatGPT Are Providing Fake URLs for Major Companies

Hackers Leak Allegedly Stolen Telefónica Data

.es Domains Become 19 Times More Popular Among Phishers