Crypto hardware company Trezor has acknowledged a continuing multi-channel phishing campaign designed to trick clients into granting access to their crypto wallets.
The company warned in a Twitter post:
“The attackers contact the victims via phone call, SMS, and/or email to say that there’s been a security breach or suspicious activity on their Trezor account. We have not found any evidence of a recent database breach. We will never contact you via calls or SMS.”
Trezor offers hardware-based wallets for the users to store their crypto. Although it is nominally a more secure method than the software-based wallets, in case the users get tricked into handing over their “recovery seed” it might give scammers access to their funds.
The 12- or 24-character password is expected to help users who have a lost, stolen, or malfunctioning device to help restore their wallet on another available device.
Users went on Twitter to post screenshots of the phishing scam. In one message, a spoofed Trezor notice encouraged users to upgrade their wallets since it “failed to complete the new Ethereum Merge.”
In another post, users are told that “Trezor Suite has recently endured a security breach” and that they need to follow a link to “secure your assets.” Doing this would take them to a phishing page spoofed to seem like a legitimate Trezor site.
“At this moment it’s technically impossible to accurately assess the scope of the data breach. Due to these circumstances, if you’ve recently used your Trezor Suite, we must assume that all your assets are currently at risk. In the spirit of transparency, we want to make our customers aware of this incident.”
“We felt time was of the essence, and we are expediently working through our investigation. If you received this message it means that you’ve been affected by the breach. To protect all your assets please follow the procedure to secure your assets.”
Clicking on the ‘Start’ button would then take the vulnerable user to a page to enter their recovery seed.
Buy Bitcoin NowIt is not the first time Trezor users have been targeted in this manner. In April 2022, a highly convincing phishing campaign got sent out to users after their contact details were stolen from a newsletter mailing list that is hosted by MailChimp.
