chat
expand_more

Ledger Impersonated in Cryptocurrency Scam

Cybercriminals attempted a phishing scam to access cryptocurrency wallets by impersonating Ledger.
December 21, 2020

Cybercriminals are desperate to obtain recovery phrases of cryptocurrency wallet users, as those phrases allow them to gain access to peoples' sensitive information and crypto assets. In this attack, malicious actors impersonate Ledger—a hardware wallet that stores users' private keys to cryptocurrency—to steal the security phrases needed to access the virtual currency.

Summary of Attack Target

  • Platform: Office 355
  • Email Security Bypassed: Proofpoint
  • Payload: Malicious Link
  • Technique: Brand Impersonation

Overview of the Cryptocurrency Attack

This attacker impersonates Ledger, a company that develops security and infrastructure solutions for cryptocurrencies and blockchain applications, by sending a convincing email that mimics Ledger’s security notification email. The email masquerades as a new device sign-in alert, states that a new sign-in has occurred from Ukraine, and contains a list of details, including an address, user agent details, and browser. The email then urges the recipient to visit the link to cancel the device authorization.

Phishing scam email impersonating Ledger
The phishing scam email impersonating Ledger

The email contains a link that takes the recipient to a Google Doc, which says that they are being sent to www.ledger.com. When the recipient clicks on the link, they get redirected to a fake phishing page that looks like the legitimate Ledger website.

fake ledger page crypto phishing scam
The fake Ledger page that users are directed to

The attacker attempts to fool the recipient by putting “ledger.com” in the URL, but the domain of this fake site, “device-id-89044.app”, has no relation to Ledger. The site then asks the recipient to choose their device to continue. Once the device is selected, it shows a secure connection loading page, then instructs the user to connect their device and click continue.

Ledger phishing scam connect device
The fake Ledger page asking users to connect their device

Upon hitting the continue button, the phishing site asks for the user's recovery phrase as the result of a fake error.

Fake Ledger connection error
A fake error page which asks users to input their recovery phrase

If the recipient does fall subject to this attack and inputs their recovery phrase, which is a vital piece of information to any hardware wallet user, the attacker will have access to all the information on the victim’s Ledger hardware wallet and access to all of their crypto assets. From there, the attacker can spend or transfer them immediately.

Why the Cryptocurrency Attack is Effective

An unauthorized sign-in notification is often disconcerting and people are quick to jump on it, especially if the account is associated with their assets. This email attack utilizes this notification method and motivates the recipient to stop the authorized sign-in by clicking on a malicious link as quickly as possible.

In addition, the attacker portrays a sophisticated phishing site that can easily give a false sense of legitimacy to the recipient. The landing page looks exactly the same as the official page of Ledger. The way that the site shows a secure connection loading page, error message, and asks the user to enter their recovery phrase, all look convincing and legitimate.

Abnormal Security detecting ledger phishing scam
Abnormal Security detecting the Ledger crypto phishing scam

Abnormal is able to detect this attack due to the unusual sender, the links detected in the cloud-sharing document, and the language that indicates that the email may be trying to steal personal information. Combined, these indicators provide enough information to indicate that this email is malicious and as a result, Abnormal stops it immediately.

To learn more about how to protect your email from brand impersonation scams, request a demo of the Abnormal platform today.

Ledger Impersonated in Cryptocurrency Scam

See Abnormal in Action

Get a Demo

Get the Latest Email Security Insights

Subscribe to our newsletter to receive updates on the latest attacks and new trends in the email threat landscape.

 

See the Abnormal Solution to the Email Security Problem

Protect your organization from the full spectrum of email attacks with Abnormal.

 
Integrates Insights Reporting 09 08 22

Related Posts

B Complex Case of Account Compromise Blog
Discover how Abnormal helped one organization detect the sophisticated tactics an attacker used to compromise an employee's email account.
Read More
B Cross Platform Account Takeover
Discover the dangers of cross-platform account takeover, the challenges of detecting this attack, and how to implement proactive protection against ATO.
Read More
B 5 17 24 Legal
Learn how cybercriminals use superficial disclaimers to deceive others while facilitating illegal activity on cybercrime forums.
Read More
B Cybersecurity Influencers Blog 2024
Stay up to date on the latest cybersecurity trends, industry news, and best practices by following these 15 innovative and influential thought leaders on social media.
Read More
B 5 13 24 Docusign
Cybercriminals are abusing Docusign by selling customizable phishing templates on cybercrime forums, allowing attackers to steal credentials for phishing and business email compromise (BEC) scams.
Read More
B CRN
Abnormal employees honored as CRN 2024 Women of the Channel for their influential leadership in the tech industry.
Read More