grep -rl "crypto" ./articles
Revolut handed passports, verification selfies and full transaction histories for a limited number of customers to someone writing from a genuine government agency email domain. SPF, DKIM and DMARC all passed, correctly. Those checks confirm which domain sent a message. They say nothing about whether the sender has any right to ask.
Phishing that reached 347,000 Trezor newsletter subscribers came from Trezor's genuine Brevo account, so it passed every sender check. Brevo's post-mortem says the attacker created an account, switched on single sign-on, invited real Brevo users into it, and was then let into every organisation those users could reach. Early coverage spoke of stolen login details. Brevo's account involves none.
Trezor says it repeatedly asked its logistics provider to delete customer data and repeatedly received written confirmation that it had been. On 5 September it disclosed that 67,000 US customers' names, phone numbers and home addresses from 2019 to 2021 were in a breach at that provider — matched, in every case, to the purchase of a hardware wallet.
Socket found 40 malicious Firefox extensions posing as OKX, Rabby Wallet and TronLink, inside a wider set of 77 sharing code and infrastructure. The clever part is not the theft — it is that many started life as harmless utilities and were repurposed later, keeping the ID, the listing and whatever trust it had accumulated.