Threat Actors Use Google Ads To Target Ledger Users
Attackers used malicious Google ads to phish Ledger users for cryptocurrency recovery phrases.
Zscaler ThreatLabz observed malicious Google search ads impersonating Ledger and targeting users in the United States, Europe, and parts of Asia. Clicks passed through Google Cloud Storage, Vercel, and Google Sites to a fake Ledger page; Vercel domains rotated about every 15-20 minutes. The page collected device and interaction data, then prompted users twice for a BIP-39 secret recovery phrase and sent both submissions to an attacker-controlled Vercel endpoint. With that phrase, attackers can restore the wallet and move funds without the physical device.
- Malicious Google ads impersonated Ledger and rotated Vercel redirect domains.
- A verified German advertiser account may have been compromised to run the ads.
- The fake page collected BIP-39 recovery phrases and sent them to attackers.
- Autocomplete used the 2,048-word English wordlist, then demanded a second entry.
- ATT&CK
- T1566.002 Spearphishing LinkT1204.001 User Execution: Malicious LinkT1056.003 Web Portal Capture
- Vendors
- GoogleLedgerVercelCloudflare
- Victims
- Ledger users
- Countries
- United StatesGermany
From the original article
3 min read at zscaler.com
IntroductionIn August 2026, Zscaler ThreatLabz analyzed a phishing campaign that used fraudulent Google ads to target Ledger hardware wallet users. The ads redirected users through Google Cloud Storage and Vercel to a Google Sites page containing a phishing page impersonating Ledger in an iframe. During our analysis, the Vercel redirect appeared to change every 15-20 minutes.
By Prakhar Shrotriya (Security Researcher) · zscaler.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.