An Electrum user operating a two-of-three multisignature Trezor setup submitted an incident report after noticing a substituted outgoing transaction in local history

From the articleBitcoin wallet bug let rogue servers steal funds when users tried to speed up paymentsAlso in Rogue Electrum servers swap real payments for zero-fee fakes