Recent Developments in the Ledger Supply Chain Incident
Recent developments in the Ledger supply chain incident have allowed scammers to exploit the situation, leading to the emergence of a fraudulent campaign that masquerades as a legitimate firmware update. The blockchain security firm SlowMist has released information alerting the public to this threat, advising users against clicking on links to perform updates or entering their recovery phrases on unofficial websites.
Official Security Communication
Ledger has reiterated its position regarding security communication: they will never initiate contact via calls or direct messages, nor will they request a user’s 24-word recovery phrase. All firmware upgrades should occur exclusively through the official Ledger Live app installed directly on the user’s device, rather than through links found in potentially deceptive communications. Any sense of urgency in such messages should be a red flag, and recipients are urged to delete them immediately.
If anyone has already entered their recovery phrase into a suspicious site, they should consider their wallet compromised and take immediate action to transfer their assets to a new device with a unique seed.
The Phishing Campaign
The campaign detailed by SlowMist appears sophisticated. It includes polished emails appearing to be from The Ledger Team, falsely notifying users about a new firmware update necessary to safeguard against a noted increase in spyware threats. The emails reference recent security issues arising in Malaysia and warn of unauthorized applications that could lead to theft of funds.
Devices claimed to be affected include the Nano S Plus, Nano X, Flex, Stax, and Nano Gen5, and the emails promise enhanced spyware protection alongside critical security updates.
Counterfeit Webpages and User Exploitation
At the conclusion of the emails is a clearly labeled “Update Now” button, which, when clicked, directs victims to a counterfeit “Genuine check” webpage that mimics the authentic Ledger verification process. The phishing scheme further directs users in selecting their device and suggests they purchase through Ledger’s authorized reseller network, cleverly leveraging the advice users have been accustomed to receiving in light of recent security alerts. The ultimate goal is to extract the recovery phrase from the victim.
Exploitation of Panic
Phishing attempts thrive in moments of panic, and with Ledger users already alerted to potential device vulnerabilities and encouraged to stay vigilant, any message suggesting a necessary “security update” could easily be misconstrued as trustworthy. Given Ledger’s warnings about potential exploitation of the chaos following their incident, the rise in phishing attempts became evident almost immediately after the initial fallout.
