Phishing scammers capitalise on Ledger panic with fake firmware update

Phishing scammers are capitalizing on the recent $86 million Ledger spyware scandal with a new “firmware update” phishing campaign.

Blockchain security firm SlowMist flagged the scam, sharing screenshots of an email which urges the recipient to connect their hardware wallet to “protect your device against emerging spyware threats, such as recent incidents in Malaysia.”

This type of phishing campaign is a common tactic employed by scammers looking to take advantage of the fear created by such incidents.

The campaign doesn’t currently appear on Ledger’s own “ongoing phishing scams” webpage, which instead warns of campaigns linked to previous data leaks.

Read more: Ledger says Southeast Asia reseller linked to $86M draining

Last week, reports of the mass-draining of Ledger devices were quickly linked to authorized reseller CryptoBilis, which operates in South East Asia.

Former CEO Arravind Prabu stated that the company was “acquired earlier this year,” with a confidentiality agreement in place “until Oct 19.”

After the company changed hands, former Mt. Gox CEO Mark Karpelès found devices fitted with spyware which tapped into the display unit before transmitting the data via a hidden SIM card.

Read more: Ledger sued for $500M over its many data breaches

It appears that the looming deadline, together with Karpelès findings, prompted the spyware operators to pull the trigger on the operation, which claimed a total of $86 million in crypto.

Unconfirmed reports have since circulated of devices in other regions, with European reseller MediaMarkt suspending sales, and Ledger urging other distributors to do the same.

While it’s been a tough week for Ledger, bafflingly, the firm took the opportunity to announce a new device yesterday. The phone-like Atom is an Android device fitted with a data-only eSIM, which cannot make calls.

Read more: Ledger roasted over $849 device launch after $86M hack 

No honor among thieves

According to crypto forensics firm Chainalysis, one of the largest (and potentially most dangerous) victims of the recent Ledger draining campaign was a “task scam” operator.

Read more: Ledger spyware scare spreads beyond Southeast Asia

The funds, which totalled “more than 60 BTC, about $4.8 million” were drained from three compromised Ledger devices and were the proceeds of a scam in which “people were paid to fake sales and reviews of real items” before being tricked into sending money in order to withdraw their payment.

The funds had been sent to the compromised devices just three weeks before being emptied during the October 9 mass draining event.

Chainalysis’ post was shared by Ledger CEO Pascal Gauthier, a move which wasn’t well received, to say the least.

One X user accused Gauthier of a lack of self-awareness, while another called for him to resign. A third said “Ledger truly deserves to go bankrupt.”

Got a tip? Send us an email securely via Protos Leaks. For more informed news and investigations, follow us on X, Bluesky, and Google News, or subscribe to our YouTube channel.

The post Phishing scammers capitalise on Ledger panic with fake firmware update appeared first on Protos.