Phishing scammers spoof Ledger’s email to send bogus data breach notice

As a seasoned crypto investor with a few battle scars under my belt, I can’t stress enough the importance of vigilance and caution when it comes to online security. The recent phishing attempts targeting Ledger users are yet another reminder that cybercriminals are always lurking in the shadows, waiting for the slightest mistake to pounce.

Users of Ledger wallets have shared experiences where phishing scoundrels mimic the support emails from the company providing the cryptocurrency hardware wallet, with the intention of fooling users into disclosing their wallet access codes.

The fake email alleges that Ledger experienced a “recent data leak” and asks recipients to confirm their personal seed phrase supposedly for the purpose of “protecting” their investments. This tactic was exposed in screenshots posted on X, as well as reported by BleepingComputer on Dec. 17.

It seems the email is claiming to originate from a genuine support address at Ledger, but according to BleepingComputer, it was actually distributed via an email marketing service instead.

The emailed link takes you to a website, which seems genuine and carries the Ledger brand. It asks users to verify their Ledger devices, but in reality, it’s checking for potential compromise that doesn’t actually exist.

The given prompt initiates a dialog box requesting users to input a unique sequence of terms known as a “seed phrase”. If this information is disclosed, it grants potential thieves complete authority over the digital wallet, enabling them to empty its resources.

In response to a user’s concern about suspicious emails, Ledger stated that “attempts at scams are regrettably common in the digital world, and nobody is entirely immune.

The message states that Ledger will never contact you via call, direct message, or ask for your 24-word recovery phrase. If anyone does, be aware it’s likely a scam.

There’s some doubt as to whether any Ledger users have been affected by the phishing scheme. CryptoMoon has reached out to Ledger for a statement on this matter.

As a crypto investor, I’ve found myself in a predicament following an unfortunate event on Dec. 13. Another Ledger user reported the loss of approximately $2.5 million worth of Bitcoin (BTC) and non-fungible tokens, despite asserting that they had never disclosed their seed phrase publicly. This incident serves as a grim reminder for us all to prioritize the security of our digital assets.

Conversely, Ledger and other blockchain security companies firmly believe that the user fell victim to a phishing attack in February 2022, and the funds were not emptied until more recently.

As a researcher studying the world of blockchain and decentralized finance, I found myself grappling with a concerning incident that unfolded in December 2023. Regrettably, the codebase of Ledger’s connector library – a crucial tool enabling Ledger users to interact with various decentralized finance applications – succumbed to an attack. This unfortunate breach allowed a malicious actor to siphon off approximately $484,000 from innocent victims.

It is predicted that the number of phishing attempts will likely surge during the approaching holiday season due to a projected uptick in online purchases, according to security experts.

Recently, Meta has alerted its users about various deceptive schemes that aim to trick holiday shoppers. These include fake offers for Christmas gift boxes, sham holiday decoration sales, and counterfeit retail vouchers.

Scam artists involved in cryptocurrency might aim to recover some lost territory during the holiday season, as the amount of money lost through phishing decreased by 53% from October to November, reaching approximately $9.3 million.

2024-12-18 07:23

Read More