Threat Actors Use Google Ads To Target Ledger Users
Attackers used malicious Google ads to phish Ledger users for cryptocurrency recovery phrases.
Zscaler ThreatLabz observed malicious Google search ads impersonating Ledger and targeting users in the United States, Europe, and parts of Asia. Clicks passed through Google Cloud Storage, Vercel, and Google Sites to a fake Ledger page; Vercel domains rotated about every 15-20 minutes. The page collected device and interaction data, then prompted users twice for a BIP-39 secret recovery phrase and sent both submissions to an attacker-controlled Vercel endpoint. With that phrase, attackers can restore the wallet and move funds without the physical device.
- Malicious Google ads impersonated Ledger and rotated Vercel redirect domains.
- A verified German advertiser account may have been compromised to run the ads.
- The fake page collected BIP-39 recovery phrases and sent them to attackers.
- Autocomplete used the 2,048-word English wordlist, then demanded a second entry.
Full article622 words · extracted from zscaler.com · click to collapse
Technical Analysis
The following sections examine the campaign’s redirect chain, phishing page, and recovery phrase collection process.
ThreatLabz observed malicious sponsored ads in search results for Ledger-related terms. The ads targeted users in the United States, Europe, and parts of Asia. An example of a malicious Google ad is shown below.
Figure 2: Malicious Google ad impersonating Ledger in search results.
The ad displayed google.com and “10L+ visits in the past month” (“10L” means 1 million in Indian numbering). The visit count appears to refer to google.com rather than the phishing destination, which may have made the ad look more credible. The ad came from a long-standing, verified advertiser account with no observed history of malicious ads. The threat actor may have compromised the account to run the campaign.
Figure 3: Google’s advertiser information for the malicious Google ad, showing a verified advertiser identity and a location in Germany.
Clicking the malicious ad took users to a Google Cloud Storage URL, which redirected them to a Vercel-hosted page. That page then redirected users to a Google Sites page displaying the phishing page in an iframe. The attack also used Vercel-hosted domains to serve the phishing content displayed in the iframe. The Vercel domain in the JavaScript redirect appeared to change approximately every 15-20 minutes during our analysis, making the activity harder to detect based on the reputation of the domain.
The two HTML examples below show that the JavaScript redirect points to a different Vercel-hosted domain in the later sample.
Figure 4: The two HTML examples showing that the JavaScript redirect points to a different Vercel-hosted domain.
The phishing page mimicked the official Ledger interface and offered downloads for Windows, macOS, Linux, and mobile devices. The phishing page collected device metadata and monitored user interactions like keypresses, touches, and mouse movements. It sent this data to a Vercel-hosted endpoint, potentially allowing attackers to distinguish real visitors from automated analysis tools. The phishing page also included a Cloudflare Web Analytics beacon (beacon.min.js) configured with an analytics token. The phishing page is shown below.
Figure 5: The phishing page impersonating Ledger.
The phishing page allowed the user to select a device type when downloading the Ledger app, as shown below.
Figure 6: Ledger device options displayed on the phishing page.
After selecting a device, the user was presented with messages such as "Connecting your Ledger" and "Initializing Firmware Update." The phishing page then claimed that the Ledger device was connected and asked the user to confirm device ownership, as shown in the figure below.
Figure 7: Fraudulent prompt asking the user to confirm ownership.
The phishing page then prompted the user to enter their secret recovery phrase, as shown in the figure below.
Figure 8: Fraudulent secret recovery phrase entry interface with autocomplete feature.
A secret recovery phrase (SRP) allows a user to restore a cryptocurrency wallet. By stealing this phrase, attackers can restore the wallet in compatible software and transfer funds without access to the victim’s physical Ledger device. The phishing page retrieves the 2,048-word BIP-39 English wordlist from api/bip39-english.txt and uses it to provide autocomplete suggestions in each recovery phrase field. As the user types, a dropdown displays matching words from the list.
When the user first submitted their recovery phrase, the page sent it to an attacker-controlled Vercel domain. The page also initialized an hCaptcha widget in invisible mode during submission. The page then displayed an error message: “Invalid seed. Please re-enter your recovery phrase carefully.” After the user submitted the phrase again, the page sent the second submission to the attacker-controlled endpoint and redirected the user to the initial landing page. ThreatLabz did not observe server-side logic comparing the two submissions.