Fake STM32 Alert Phishes Trezor and BitBox Users

On Sept. 9, phishing emails impersonated hardware‑wallet makers Trezor and BitBox. The messages used the subject “Critical Security Alert: STM32 Entropy Vulnerability” and followed breaches at third‑party email and newsletter providers.

Trezor confirmed the messages did not come from the company and traced the incident to a compromised third‑party email provider. It removed the fraudulent domain used in the campaign and is investigating how attackers gained access to a domain tied to its communications. A follow‑up on Sept. 10 reiterated that Trezor devices and firmware were not breached.

BitBox reported a likely compromise at its newsletter provider and said several other Bitcoin firms appeared to share the same service. Most phishing links had been removed by the time BitBox issued an update. The company notified newsletter subscribers, contacted the provider and reported the phishing domains to hosting services and law enforcement. Its investigation is ongoing.

The phishing subject referenced STM32 microcontrollers, components commonly used in hardware devices. Security teams note the technical wording was intended to make the message look like an urgent advisory and to prompt recipients to click links or disclose information.

Both wallet makers stressed that devices and firmware were not directly breached and described social engineering as the primary threat. Revealing a wallet’s recovery seed or installing software from an untrusted link can allow attackers to move funds even when a device itself remains secure. Trezor reiterated guidance to never share recovery words, to avoid suspicious links and attachments, and to download Trezor Suite only from the official website. BitBox advised checking official company channels for any legitimate follow‑up rather than using links in unexpected emails.

Users who received the fake alerts were told to ignore the emails and to verify security notices on the wallet makers’ verified websites or social channels. Both companies reported the phishing domains to hosting providers and law enforcement.

Breaches at third‑party communication services can expose email lists and brand assets while core products remain secure. Users are advised to treat unexpected technical alerts with caution, confirm messages through official channels and never enter recovery seeds or private keys into web forms or messages.