Trezor users exposed to unicode domain phishing attack

Trezor¹ users have been exposed to an unicode domain phishing attack:

A scam email warning of a data breach is circulating. Do not open any email originating from noreply@trezor.us, it is a phishing domain.²

The email has a clear subject line (Your Trezor Suite might be compromised) and attempts to direct users to fake domains (suite.trẹzor.com/suite.xn--trzor-o51b.com/trezor.us) in order to download a bogus software update and steal their private seeds.

It appears that Trezor has been using a third party service (MailChimp³) for their opt-in newsletter, which lead to this situation:

We are investigating a potential data breach of an opt-in newsletter hosted on MailChimp.⁴

MailChimp have confirmed that their service has been compromised by an insider targeting crypto companies.⁵

Sethforprivacy⁶ has admitted falling for this type of attack for the first time ever:

Tonight I fell for a phishing email for the first time ever.⁷

I wasn’t affected at all, but I did raise an embarrassing false alarm on Twitter and apologize for that.⁸

Thankful for all those that corrected me and pointed out it was a phishing email.⁹

A lot of Trezor users¹⁰’¹¹’¹² that have received the scam email are insisting that they have not opted into any newsletter, including Seth:

Leaked from MailChimp, apparently, though I didn’t sign up for any newsletters [..]¹³

Users that did not click the link in the email, download the bogus update or share the private seed were not affected.

It might be pragmatic to assume that all Trezor email addresses are already circulating in an email list somewhere, and thus compromised/a target for future attacks.

This is not the first time Trezor disappoints its users this year. Read my previous reports¹⁴’¹⁵ to learn more about the AOPP fiasco.