signs of phishing Phishing scam targeting Ledger wallet owners Attackers spin poignant tales of lost private keys as they try to phish seed phrases. Roman Dedenok August 21, 2025 Until recently, scammers have mainly focused on targeting cryptocurrency wallets owned by individual users. However, it appears that businesses are increasingly using cryptocurrencies, so attackers are now trying to get their hands on corporate wallets as well. You don’t have to look far for examples. The recently studied Efimer malware, which was distributed to organizations, is capable of swapping cryptocurrency wallet addresses in the clipboard. So we weren’t really surprised to observe cryptocurrency phishing campaigns directed at both individual and corporate users. What did come as a surprise though was the sophistication of the cover story and overall sophistication of the scam. The phishing scheme This particular scheme targets users of Ledger hardware cryptocurrency wallets — specifically the Nano X and Nano S Plus. The scammers send out a phishing email with a lengthy apology. The email claims that, due to a technical flaw, segments of the users’ private keys were transmitted to a Ledger server; the data was well-protected and encrypted, but the “company’s team” had discovered a highly complex data breach. The attackers’ fake story goes on to state that they’d exfiltrated fragments of keys, and then used extremely advanced methods to decrypt and reconstruct some of them — “leading to the theft of crypto assets”. Users are then advised to prevent their crypto wallets from being compromised through the same vulnerability, with the attackers recommending immediately updating the firmware of their device. Phishing prompt to update the firmware It’s a compelling story, to be sure. But if you apply some critical thinking, a few inconsistencies crop up. For example, it’s unclear how a fragment of a key could be used to reconstruct the whole thing. It’s also completely baffling what these “advanced decryption methods” are, and how Ledger representatives supposedly know about them. The email itself is crafted extremely carefully: there’s almost nothing to nitpick. It wasn’t even sent with the help of standard scammer tools; instead, the attackers used a legitimate mailing service, SendGrid. This means the emails have a good reputation and often bypass anti-phishing filters. The only red flags are the sender’s domain and the domain of the website users are told to visit for the firmware update. Needless to say, neither has any connection to Ledger. The scammers’ website The website is also very clean and professionally designed — if you ignore the completely irrelevant domain it’s hosted on, that is. It’s possible the site serves multiple scams, as there’s no mention of a firmware update, and it lists far more devices than the email does. The website even has a functional support chat! While that’s most likely a chatbot, it does respond to questions and gives seemingly helpful advice. The whole point of the site is to get you to enter your seed phrase after you select your device. The interface for entering seed phrases A seed phrase is a randomly generated sequence of words used for recovering access to a cryptocurrency wallet. And as you may have guessed, it should not be entered, as anyone who knows it can gain full access to your crypto assets. On a separate note, when you search for similar sites on Google, you’ll find a surprising number of similar fake pages. This type of scam is clearly quite popular. How to stay out of harm’s way? Whether you manage your crypto assets on your own devices or simply use regular online banking apps, it’s crucial to stay informed about the latest tactics attackers are using. For company employees, we recommend specialized training tools to boost their awareness of modern cyberthreats. One effective way to do this is by using the Kaspersky Automated Security Awareness Platform. For home users, our blog is a great resource for learning how to spot phishing scams. Additionally, we recommend installing a robust security solution on both the personal and work devices you use for financial transactions. These solutions can both block access to phishing sites and prevent data breaches.
Read next Practical exploitation of Retbleed on AMD CPUs Google experts have demonstrated how complex hardware vulnerabilities in CPUs can be effectively exploited.
Tips How to improve your resume with AI without exposing your data Let’s look at how to use AI as a resume editor without oversharing to build a document that gets past automated screening systems and catches a recruiter’s eye.
Tips How can students overcome the fear of unfulfilled potential, and where does cybersecurity come into it? University students sometimes don’t see the practical value of what they’re studying, and aren’t always sure what to do next. Kaspersky Academy’s free “Cybersecurity. Entry Level” course can help them pick up in-demand skills directly from Kaspersky experts.
Tips Nine reasons to set up a VPN on your router Get the most speed, reliability, and convenience out of your VPN by putting it on your router. Here’s a look at the real benefits of specific VPN setup scenarios for your whole home network.
Tips Fact and fiction about hidden Wi-Fi network names Hiding your Wi-Fi network name might seem like a smart security move, but in practice it does more harm than good. Let’s take a look at how it works, what side effects it can have, and how to properly secure your home Wi-Fi.