Fake Ledger Firmware Update Phishing Campaign (October 2026)
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·28DFUb…3xSsSummary
In October 2026, security firm SlowMist identified a phishing campaign targeting Ledger hardware wallet users through fraudulent firmware update notifications. The campaign opportunistically exploited user anxiety following the separately documented CryptoBilis supply chain incident, directing victims to counterfeit 'Genuine Check' verification pages designed to harvest 24-word Secret Recovery Phrases. The attack is distinct from the CryptoBilis hardware implant incident but shares its victims and timing.
Connected Entities
1 entityNo connected entities recorded yet — this investigation is not currently linked to any other page in the index.
Timeline(7 events)
1 July 2020
Ledger customer database breach exposes email addresses of approximately 1 million customers and personal data of approximately 272,000 customers, enabling targeted phishing campaigns in subsequent years.
GridinSoft Blog1 August 2026
Zscaler ThreatLabz begins analysis of a Google Ads-based phishing campaign targeting Ledger users in the US, Europe, and Asia, using a multi-stage redirect chain through Google Cloud Storage, Vercel, and Google Sites.
Zscaler ThreatLabz25 September 2026
Zscaler ThreatLabz publishes detailed investigation of the Google Ads-based Ledger phishing campaign, classifying the signature as HTML.Phish.Ledger and documenting infrastructure including attacker-controlled Vercel endpoints and Google Sites pages.
Security Boulevard / Zscaler ThreatLabz9 October 2026
Ledger discloses an active investigation into reports of stolen cryptocurrency linked to Southeast Asian reseller CryptoBilis; the company requests a sales suspension for CryptoBilis.
CoinDesk10 October 2026
Security researcher Cyber Scrilla identifies a new fake Ledger website appearing in search results, coinciding with the CryptoBilis news cycle.
crypto.news12 October 2026
Ledger confirms an unauthorized hardware implant was found in at least one device sold by CryptoBilis. The implant captured 24-word recovery phrases during device setup via an embedded eSIM transmitting over LTE.
The Hacker News / CoinDesk16 October 2026
SlowMist publicly warns of the fake firmware update phishing campaign, documenting counterfeit 'Genuine Check' pages designed to harvest Secret Recovery Phrases from users alarmed by the CryptoBilis incident.
CryptoTimes / TechFlow / KuCoin News / PhemexDecision Log
- slot 457631852 · hash CyDjHHuwFLTi9nK6tA6qCeoASGEkGFeF3hoCvD1dbPLF
This investigation is cryptographically anchored to the Solana blockchain (1 decision). 12 of 17 cited source URLs have an Internet Archive snapshot.
model: claude-code-investigator
generated: 10/16/2026, 12:07:18 PM
last updated: 10/16/2026, 12:07:18 PM
avoid.net — verified advice for a post-truth world