bridge-hub-trez[.]zapier[.]app

This domain, bridge-hub-trez.zapier.app, poses as an official download portal for Trézór Bridge software, a tool used to connect hardware wallets to computers. Analysis indicates the site is a phishing operation designed to distribute malicious software under the guise of legitimate cryptocurrency infrastructure. Victims who download and install the fake software risk exposing sensitive wallet credentials, private keys, or other authentication details to unauthorized third parties. The presence of such malware could lead to unauthorized access to cryptocurrency holdings, resulting in financial loss or complete account compromise. Infrastructure analysis reveals multiple technical indicators confirming the malicious nature of this domain. The domain resolves to the IP address 64.239.109.1, hosted by Vercel, Inc., in the United States. It is flagged by 11 out of 95 security vendors on VirusTotal, with detections categorized under generic phishing. The domain was registered through Name.com, Inc., a registrar commonly associated with both legitimate and fraudulent domains. Additionally, the domain appears on at least one security blocklist and was blocked by PhishDestroy, further corroborating its classification as a phishing threat. The page title, 'Download Trézór Bridge®™,' directly impersonates the official Trézór brand, a tactic frequently employed to deceive users into trusting the source. Individuals who visited bridge-hub-trez.zapier.app or downloaded files from it should take immediate action to mitigate potential risks. First, disconnect the affected device from the internet to prevent further data transmission to malicious actors. Perform a full system scan using updated security software to detect and remove any installed malware. If cryptocurrency wallet credentials or private keys were entered on the site or any associated forms, assume they are compromised and transfer assets to a new, secure wallet immediately. Monitor all linked accounts for unauthorized transactions and enable multi-factor authentication where available. Users should also report the domain to their security software provider to aid in broader threat intelligence efforts. Given the elevated risk level, affected individuals may consider resetting their device to factory settings to ensure complete removal of any persistent threats.