Trezor investigates phishing attack that left 66k users vulnerable