Can a phishing email come from an official address?

Checking an email’s sender is useful, but it is not a final safety test. A display name can be copied, a lookalike domain can be registered, and a legitimate sending service can be abused. These are different mechanisms with the same practical consequence: the message’s instructions need independent verification.

A real delivery route can carry a fraudulent request

Companies often use outside platforms to send newsletters and service messages. If an attacker obtains access to that platform or a customer account within it, the attacker may send messages through infrastructure the company genuinely uses. The visible sender can therefore look more convincing than an ordinary impersonation.

Email authentication checks help establish facts about the sending domain and delivery route. They do not prove that an authorized employee approved the content, that the linked application is safe or that a request for your wallet backup is legitimate. A passed authentication check is not a security review of the message.

What Trezor reported about Brevo

Trezor reported that an attacker abused its third-party newsletter provider, Brevo, on September 9, 2026, to send a malicious email from Trezor’s account. The message promoted a fabricated STM32 entropy vulnerability and directed recipients toward an application that requested their wallet backup. The supposed hardware flaw was the phishing story, not a verified vulnerability.

In its September 17 update, Trezor said 347,149 marketing email contacts had been exported. It reported that no Trezor product, wallet or account system was affected. These are the vendor’s reported findings, not evidence that recipients’ recovery phrases were stolen. The Trezor Brevo incident explainer separates those categories.

Judge the action, not just the envelope

Do not use the email’s unsubscribe link as your first response to a suspicious message. Use your mail provider’s reporting controls instead. If you need clarification, follow the process in verifying a support message, using contact details obtained outside the email.

Receiving is not the same as exposing a wallet

Receiving the message does not by itself establish access to your wallet. If you clicked, downloaded software, entered account credentials or approved something, record those actions separately and consult the manufacturer’s official response guidance. If recovery words were disclosed, treat them as compromised and seek urgent vendor instructions from a separate trusted device.

A leaked newsletter address can make later impersonation more targeted without revealing wallet keys. Understanding customer-data exposure versus key theft helps you respond to the actual evidence instead of the email’s urgency.