An unknown threat actor has compromised the internal infrastructure of the email marketing firm Mailchimp via a successful social engineering phishing attack. The phishing attack allowed the threat actor to steal a Mailchimp employee’s credentials and intrude into the network. The threat actor was then able to gain access into 319 Mailchimp accounts for companies within the finance and cryptocurrency industries. Notably, the actor was only able to export audience data from around 32% of those accounts. In one such case, one of the compromised accounts was tied to the Trezor cryptocurrency app. The threat actor utilized Trezor’s Mailchimp account to contact users of the platform to download a fake platform update, which allowed the actor to gather cryptocurrency seed information and close the associated accounts. It is unclear how many of these users are currently affected or have lost their cryptocurrency wallets. CTIX continues to urge users to verify the integrity of emails prior to downloading any attachments or visiting any hyperlinked addresses.