Customers of Ledger, the hardware cryptocurrency wallet, are being targeted by a phishing attack posing as an email from Ledger support.
On Sunday a Reddit user posted in the r/ethfinance subreddit, alerting the group to the existence of the attack.
The fake email ostensibly informs users their Ledger assets may be compromised. It states, “Our forensics team has found several of the Ledger Live administrative servers to be infected with malware.” This claim is false; while the email form looks professional, it is a phishing attempt to steal customers data.
The email is so convincing that even wary users might be fooled. Ledger confirmed that, for the last week, a phishing attack has been targeting Ledger cryptocurrency wallet customers.
“I received the same email and for once I got really confused. Everything checks out,” said one Reddit user in reply to the original post. “However, there you can see that the url is incorrect (notice the dot on the second 'e' => ledgėr). What triggered my doubt was that I received the email twice within a couple of minutes. ... It's probably related to the previous hack where a hacker managed to get our email addresses.”
Another user replied, “Wow this looked really legit, so much so I used Contact Us form to ask Ledger if it was real. I am normally pretty good at sniffing things like this out – this was by far the most convincing attempt I have ever seen.”
Roots of a phishing attack
In July, the Ledger team discovered an API key related to their e-commerce and marketing database was exploited, and the database accessed by an unauthorized third party. The database details (mostly email addresses) were used to send order confirmations and promotional emails.
In a blog post revealing the hack, the Ledger team emphasized that users' payment information and crypto funds are safe.
CoinDesk independently reviewed one of these phishing emails, which was sent from "support@legder.com." A key clue in any phishing email is a slight misspelling of a real address or URL; in this instance, “ledger.com” is misspelled.
Phishing attacks are common and attackers are increasingly sophisticated, creating emails that resemble official company correspondence. They rely on a person making a mistake and clicking on a link that could compromise his or her security.
In a statement, a Ledger spokesperson said an internal task force has been deployed to investigate the latest phishing attack.
“The investigation is ongoing and at this time we cannot give any additional information but one thing is for certain: Ledger will never ask you for your 24-word recovery phrase, which is a blatant sign of a phishing scam,” said the spokesperson. “Ledger encourages customers to exercise caution as phishing attacks become more sophisticated and to alert Ledger's customer support team and consult Ledger.com for more information on the detection of scams.”
UPDATE (November 2, 2020, 17:46 UTC): Multiple Ledger users have shared that they are also being targeted by SMS phishing attacks, sent to their phones. CoinDesk has seen three separate examples of this phishing text below.
This is a phishing attempt and customers should not click on the link. The development further highlights customers concerns about how data stemming from the Ledger hack earlier this year is being used.
UPDATE: November 2, 2020 (19:56 UTC) Ledger responded with the following comment:
"As soon as we discovered the data breach on Ledger's website in July 2020, we immediately patched it. Since then, we led two penetration tests with a third-party consultancy to verify and improve the security of our clients' data. For two weeks, some of Ledger's customers have been experiencing continuous phishing scams through various channels, including email and SMS. We've issued several scam alerts through our Twitter, email, and other channels to notify our users during the past two weeks.
The internal task force is investigating these attacks, and as of now, we can't state that scammers are using Ledger's marketing database, and therefore, these attacks resulted from July's data breach."