Ledger Impersonated in Cryptocurrency Scam

December 21, 2020

Cybercriminals are desperate to obtain recovery phrases of cryptocurrency wallet users, as those phrases allow them to gain access to peoples' sensitive information and crypto assets. In this attack, malicious actors impersonate Ledger—a hardware wallet that stores users' private keys to cryptocurrency—to steal the security phrases needed to access the virtual currency.

Summary of Attack Target

  • Platform: Office 355
  • Email Security Bypassed: Proofpoint
  • Payload: Malicious Link
  • Technique: Brand Impersonation

Overview of the Cryptocurrency Attack

This attacker impersonates Ledger, a company that develops security and infrastructure solutions for cryptocurrencies and blockchain applications, by sending a convincing email that mimics Ledger’s security notification email. The email masquerades as a new device sign-in alert, states that a new sign-in has occurred from Ukraine, and contains a list of details, including an address, user agent details, and browser. The email then urges the recipient to visit the link to cancel the device authorization.

Phishing scam email impersonating Ledger
The phishing scam email impersonating Ledger

The email contains a link that takes the recipient to a Google Doc, which says that they are being sent to www.ledger.com. When the recipient clicks on the link, they get redirected to a fake phishing page that looks like the legitimate Ledger website.

fake ledger page crypto phishing scam
The fake Ledger page that users are directed to

The attacker attempts to fool the recipient by putting “ledger.com” in the URL, but the domain of this fake site, “device-id-89044.app”, has no relation to Ledger. The site then asks the recipient to choose their device to continue. Once the device is selected, it shows a secure connection loading page, then instructs the user to connect their device and click continue.

Ledger phishing scam connect device
The fake Ledger page asking users to connect their device

Upon hitting the continue button, the phishing site asks for the user's recovery phrase as the result of a fake error.

Fake Ledger connection error
A fake error page which asks users to input their recovery phrase

If the recipient does fall subject to this attack and inputs their recovery phrase, which is a vital piece of information to any hardware wallet user, the attacker will have access to all the information on the victim’s Ledger hardware wallet and access to all of their crypto assets. From there, the attacker can spend or transfer them immediately.

Why the Cryptocurrency Attack is Effective

An unauthorized sign-in notification is often disconcerting and people are quick to jump on it, especially if the account is associated with their assets. This email attack utilizes this notification method and motivates the recipient to stop the authorized sign-in by clicking on a malicious link as quickly as possible.

In addition, the attacker portrays a sophisticated phishing site that can easily give a false sense of legitimacy to the recipient. The landing page looks exactly the same as the official page of Ledger. The way that the site shows a secure connection loading page, error message, and asks the user to enter their recovery phrase, all look convincing and legitimate.

Abnormal Security detecting ledger phishing scam
Abnormal Security detecting the Ledger crypto phishing scam

Abnormal is able to detect this attack due to the unusual sender, the links detected in the cloud-sharing document, and the language that indicates that the email may be trying to steal personal information. Combined, these indicators provide enough information to indicate that this email is malicious and as a result, Abnormal stops it immediately.

To learn more about how to protect your email from brand impersonation scams, request a demo of the Abnormal platform today.

Image

Prevent the Attacks That Matter Most

Get the Latest Email Security Insights

Subscribe to our newsletter to receive updates on the latest attacks and new trends in the email threat landscape.

Demo 2x 1

See the Abnormal Solution to the Email Security Problem

Protect your organization from the attacks that matter most with Abnormal Integrated Cloud Email Security.

Related Posts

B 05 13 22 Spring Product Release
This quarter, the team at Abnormal launched new features to improve lateral attack detection, role-based access control (RBAC), and explainable AI. Take a deep dive into all of the latest product enhancements.
Read More
B 05 11 22 Champion Finalist
Abnormal has been selected as a Security Customer Champion finalist in the Microsoft Security Excellence Awards! Here’s a look at why.
Read More
Blog series c cover
When we raised our Series B funding 18 months ago, I promised our customers greater value, more capabilities, and better customer support. We’ve delivered on each of those promises and as we receive an even larger investment, I’m excited about how we can continue to further deliver on each of them.
Read More
B 05 09 22 Partner Community
It’s an honor to be named one of CRN’s 2022 Women of the Channel. Here’s why I appreciate the award and what I love about being a Channel Account Manager at Abnormal.
Read More
B 05 05 22 Fast Facts
Watch this short video to learn current trends and key issues in cloud email security, including how to protect your organization against modern threats.
Read More
B 05 03 22
Like all threats in the cyber threat landscape, ransomware will continue to evolve over time. This post builds on our prior research and looks at the changes we observed in the ransomware threat landscape in the first quarter of 2022.
Read More
B 04 28 22 8 Key Differences
At Abnormal, we pride ourselves on our excellent machine learning engineering team. Here are some patterns we use to distinguish between effective and ineffective ML engineers.
Read More
B 04 26 22 Webinar Re Replacing Your SEG
Learn how Microsoft 365 and Abnormal work together to provide comprehensive defense-in-depth protection in part two of our webinar recap.
Read More
Blog mitigate threats cover
Learn about the most common socially-engineered attacks and why these tactics are still so successful—despite a growing awareness from employees.
Read More
B Podcast Engineering8
In episode 8 of Abnormal Engineering Stories, Kevin interviews Saminda Wijegunawardena, an engineering leader who is no stranger to fast-growing enterprise startups.
Read More
B 04 04 22 Webinar Recap Krebs
High-impact emails are on the rise and secure email gateways (SEGs) don’t have the functionality to mitigate them. Learn how your SEG is letting you down.
Read More
B 04 19 22 Facebook Phishing
While phishing emails have long been a popular way to steal Facebook login credentials, we’ve recently seen an increase in more sophisticated phishing attacks.
Read More