@InfobloxThreatIntel@infosec.exchange
2026-03-25 16:49 UTC
There has also been seed phrase poisoning / crypto phishing efforts which have used domains targeting Trezor, Ledger, Coinbase and likely other wallets.
Somewhat surprisingly, a recent phishing site actually had a fake blog post from Trezor titled, "Address Poisoning Attacks are Surging – Here's How Your Trezor Now Protects You" which had substantial content likely written by AI, and further links on the page to a phishing portal.
writeup-blogtrezor[.]com
Replies (1)
-
@InfobloxThreatIntel@infosec.exchange 2026-03-25 16:51
Many of the other crypto phishing pages have been simpler lures: try-trezcard[.]com live-ledgerupdate[.]com valid-ledgerlive[.]com 822037[.]help support.devicerecovery[.]io Our team at Infoblox is hopeful that with more public awareness about these ongoing campaigns from Poisonseed, hopefully fewer enterprise organizations and individuals will be impacted and we'll see a reduction in these attacks over the next year. If you have any tips or leads on this campaign or others like it, please don't hesitate to ping our team! 🖖