malware-trezore[.]zapier[.]app

This domain, malware-trezore.zapier.app, operates as a credential harvesting platform specifically targeting users of Trezor hardware wallets. Analysis indicates the site presents a fraudulent interface mimicking the official Trezor Start page, titled 'Trezor Start® — Trezor®,' designed to deceive victims into entering sensitive recovery seed phrases or private keys. The attack leverages brand impersonation to exploit trust in the Trezor brand, a common tactic in cryptocurrency-related phishing campaigns. The objective is to capture and exfiltrate credentials, enabling unauthorized access to victims' digital assets stored in Trezor wallets. Infrastructure analysis reveals multiple technical indicators supporting the malicious classification of this domain. The domain resolves to the IP address 64.239.109.1 and is registered through Name.com, Inc. Security vendor detections on VirusTotal report 19 out of 95 engines flagging the domain as malicious, while it appears on one security blocklist. The site employs a Let's Encrypt SSL certificate to create a false sense of legitimacy, alongside technologies such as Amazon Web Services, Vercel, and Amazon S3, which are often abused for hosting phishing content. Additional components, including Stripe and reCAPTCHA, are likely integrated to further mimic legitimate functionality and reduce user suspicion. Users who visited malware-trezore.zapier.app or entered sensitive information on the site should take immediate remedial actions. First, any recovery seed or private key exposed to this domain must be considered compromised and should no longer be used. Affected individuals should transfer all assets from the associated wallet to a new, secure wallet using a trusted device. It is also recommended to monitor accounts for unauthorized transactions and enable multi-factor authentication where available. Given the elevated risk level, users should report the incident to relevant security teams and consider scanning their systems for additional malware or unauthorized access points.