Audit log

Every state-changing event for Fake Ledger Firmware Update Phishing Campaign (October 2026): moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-10-16 12:07:26Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 457,631,852

   sig

   28DFUbeWizLk…JBCM3xSscopyexplorer ↗

   hash

   CyDjHHuwFLTi…vD1dbPLFcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (20379 B) ▸

   {"actor":"system:backfill","investigation_id":"e65ebb51-8a96-44bb-84c4-b8f437e84b3b","kind":"publish","page_slug":"fake-ledger-firmware-update-phishing-campaign-october-2026","published_at":"2026-10-16T12:07:26.116Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Fake Ledger Firmware Update Phishing Campaign (October 2026)","sections":[{"content":"On October 16, 2026, SlowMist publicly warned of an active phishing campaign impersonating Ledger's official firmware update process. According to SlowMist's advisory as reported by TechFlow and CryptoTimes, attackers sent unsolicited emails claiming to be from 'The Ledger Team,' asserting that a critical firmware update was required to defend against rising spyware threats — a message crafted to exploit user concern following the CryptoBilis supply chain incident disclosed on October 9, 2026. The phishing campaign is a social engineering operation; unlike the CryptoBilis incident, it does not involve hardware tampering. Its goal is to trick users into voluntarily surrendering their 24-word Secret Recovery Phrase on an attacker-controlled website.","heading":"Campaign Overview","severity":"critical","sources":[{"credibility":2,"name":"Fake Ledger Firmware Update Scam Exploits CryptoBilis Hack, SlowMist Warns — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/10/16/fake-ledger-firmware-update-scam-exploits-cryptobilis-hack-slowmist-warns/"},{"credibility":2,"name":"SlowMist: Fake Ledger Firmware Update Phishing Page Emerges, User Mnemonic Phrases Face Leakage Risk — TechFlow","type":"news_article","url":"https://www.techflowpost.com/en-US/newsletter/140221"},{"credibility":2,"name":"SlowMist: Beware of Fake 'Ledger Firmware Update' Scams — TechFlow","type":"news_article","url":"https://www.techflowpost.com/en-US/newsletter/140229"}]},{"content":"The phishing emails impersonate Ledger's official communications and contain an 'Update Now' call-to-action button. Clicking this button routes victims to a counterfeit web page that closely mimics Ledger's legitimate 'Genuine Check' device verification flow, including a device selection interface and an 'Update Now' confirmation button, according to SlowMist's findings as reported by KuCoin News and Phemex. At the final stage, victims are prompted to enter their 24-word Secret Recovery Phrase, which is transmitted directly to attacker-controlled infrastructure. Some documented variants of the broader Ledger phishing ecosystem (analyzed by Zscaler ThreatLabz in September 2026) displayed an error after the first submission and requested re-entry, allowing the attacker to collect the phrase twice. The use of a BIP-39 English wordlist for autocomplete in some variants reduced victim entry friction and increased the rate of successful phrase capture.","heading":"Attack Mechanics","severity":"critical","sources":[{"credibility":2,"name":"SlowMist Warns of Phishing Pages Impersonating Fake Ledger Firmware Updates — KuCoin News","type":"news_article","url":"https://www.kucoin.com/news/flash/slowmist-warns-of-fake-ledger-firmware-update-phishing-pages"},{"credibility":2,"name":"Fake Ledger Firmware Update Phishing Campaign Detected — Phemex News","type":"news_article","url":"https://phemex.com/news/article/fake-ledger-firmware-update-phishing-campaign-detected-amid-supply-chain-concerns-100125"},{"credibility":1,"name":"Attackers Target Ledger Users Via Google Ads — Zscaler ThreatLabz","type":"research","url":"https://www.zscaler.com/blogs/security-research/threat-actors-use-google-ads-target-ledger-users"}]},{"content":"Zscaler ThreatLabz, in a September 25, 2026 report covering a related wave of Ledger phishing (which used Google Ads as its initial vector), documented a multi-stage redirect architecture that is consistent with the October 2026 firmware update campaign. Identified infrastructure included Google Cloud Storage buckets (storage.googleapis.com/apf-leg-ad-23798/, storage.googleapis.com/ledg-leg1-79230/, storage.googleapis.com/apf-leg-ad-22076/, storage.googleapis.com/apf-leg-ad-32595/) used as intermediary redirects. Final phishing pages were served via Google Sites (sites.google.com/view/start-ledger-wallet, sites.google.com/view/apps-ledger-wallet, sites.google.com/view/download-ledger-wallet-pc) embedded in iframes. Stolen recovery phrases were transmitted to attacker-controlled Vercel domains including soyyoo-cwpc5n0e.vercel.app, rpc-gbz5.vercel.app, whyavc-qwmv6stx.vercel.app, router-wdoi.vercel.app, and node-f1ey.vercel.app. Zscaler noted the Vercel redirect endpoint rotated approximately every 15 to 20 minutes, complicating URL-reputation-based defenses. The phishing pages incorporated behavioral fingerprinting — monitoring keypresses, touch events, and mouse movements — to distinguish human users from automated analysis tools. The initial Google Ads vector leveraged a compromised long-standing verified advertiser account, lending the ads false credibility. Zscaler classified the malware signature as HTML.Phish.Ledger.","heading":"Technical Infrastructure","severity":"high","sources":[{"credibility":1,"name":"Attackers Target Ledger Users Via Google Ads — Zscaler ThreatLabz","type":"research","url":"https://www.zscaler.com/blogs/security-research/threat-actors-use-google-ads-target-ledger-users"},{"credibility":2,"name":"Threat Actors Use Google Ads To Target Ledger Users — Security Boulevard","type":"news_article","url":"https://securityboulevard.com/2026/09/threat-actors-use-google-ads-to-target-ledger-users/"},{"credibility":2,"name":"Ledger Faces Fake Website Warning Amid $86M Theft Probe — crypto.news","type":"news_article","url":"https://crypto.news/ledger-faces-fake-website-warning-amid-86m-theft-probe/"}]},{"content":"The October 2026 phishing campaign draws its social engineering power from a contemporaneous, separately documented supply chain attack. On October 9, 2026, Ledger confirmed an investigation into reports of stolen cryptocurrency linked to CryptoBilis, a Southeast Asian hardware wallet reseller. Ledger subsequently confirmed that at least one device sold through CryptoBilis contained an unauthorized hardware implant — a microcontroller that read the 24-word recovery phrase displayed on-screen during device setup and transmitted it via an embedded eSIM over LTE, according to The Hacker News and CoinDesk reporting. On-chain analysts estimated losses of approximately $86 million to $93 million from 311 to 315 affected wallets across multiple blockchains; these loss figures relate to the hardware implant incident, not the phishing campaign directly. The phishing campaign exploited the resulting user panic by framing the fake firmware update as a protective response to the spyware threat. Researchers cited by crypto.news noted that no demonstrated link between the Google Ads phishing website and the CryptoBilis hardware losses had been established, indicating these are two distinct but temporally concurrent attacks on the same user population.","heading":"Social Engineering Context: CryptoBilis Supply Chain Incident","severity":"high","sources":[{"credibility":1,"name":"Ledger Finds Unauthorized Hardware Implant in CryptoBilis-Sold Wallet Amid Fund Theft Reports — The Hacker News","type":"news_article","url":"https://thehackernews.com/2026/10/ledger-finds-unauthorized-hardware.html"},{"credibility":1,"name":"Ledger Says Unauthorized Implant Found in at Least One Device Sold by CryptoBilis — CoinDesk","type":"news_article","url":"https://www.coindesk.com/tech/2026/10/12/ledger-says-unauthorized-implant-found-in-at-least-one-device-sold-by-cryptobilis"},{"credibility":2,"name":"Ledger Faces Fake Website Warning Amid $86M Theft Probe — crypto.news","type":"news_article","url":"https://crypto.news/ledger-faces-fake-website-warning-amid-86m-theft-probe/"}]},{"content":"No confirmed victim count or direct financial loss figure attributable specifically to the October 2026 firmware update phishing campaign has been published as of this writing. Phishing traffic claims of 'more than 1 million visits over 30 days' were reported by crypto.news but were noted in that same article as unverified. The campaign's effective reach is amplified by Ledger's large user base and by the simultaneous high-profile CryptoBilis news cycle, which increases the plausibility of urgency-based lures to users already concerned about their device security. The broader Ledger phishing ecosystem documented by Zscaler targeted users in the US, Europe, and parts of Asia. The CryptoBilis hardware implant incident — the separate supply chain attack that this phishing campaign exploits as a lure — affected users primarily in Southeast Asia, Hong Kong, Malaysia, Indonesia, and the Philippines.","heading":"Scale and Reach","severity":"high","sources":[{"credibility":2,"name":"Ledger Faces Fake Website Warning Amid $86M Theft Probe — crypto.news","type":"news_article","url":"https://crypto.news/ledger-faces-fake-website-warning-amid-86m-theft-probe/"},{"credibility":1,"name":"Attackers Target Ledger Users Via Google Ads — Zscaler ThreatLabz","type":"research","url":"https://www.zscaler.com/blogs/security-research/threat-actors-use-google-ads-target-ledger-users"}]},{"content":"No named threat actor or group has been publicly attributed to the October 2026 fake firmware update phishing campaign as of the date of this investigation. SlowMist characterized the campaign as the work of a 'highly organized criminal group' in general terms relating to the broader Ledger supply chain operation. Zscaler's September 2026 analysis of the Google Ads phishing wave noted the use of a compromised legitimate advertiser account, suggesting sophisticated access to established infrastructure rather than newly registered attacker-owned accounts, but did not name a specific actor. No law enforcement action, indictment, or regulatory filing related to the October 2026 campaign has been identified.","heading":"Threat Actor Attribution","severity":"medium","sources":[{"credibility":1,"name":"Attackers Target Ledger Users Via Google Ads — Zscaler ThreatLabz","type":"research","url":"https://www.zscaler.com/blogs/security-research/threat-actors-use-google-ads-target-ledger-users"},{"credibility":2,"name":"Fake Ledger Firmware Update Scam Exploits CryptoBilis Hack, SlowMist Warns — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/10/16/fake-ledger-firmware-update-scam-exploits-cryptobilis-hack-slowmist-warns/"}]},{"content":"Ledger's official position, as stated across company communications, is that it will never call users, DM users, or ask for a 24-word Secret Recovery Phrase under any circumstances. All legitimate firmware updates are performed exclusively through the official Ledger Live desktop or mobile application, with on-device confirmation, and are never initiated through a web browser link or email. SlowMist advises users to avoid updating Ledger firmware through any website link and never to enter recovery phrases on any web page. Users who believe they may have entered their recovery phrase on a phishing page should immediately transfer all assets to a new wallet generated with a fresh recovery phrase on a verified device.","heading":"Protective Measures and Official Guidance","severity":"low","sources":[{"credibility":2,"name":"Ledger Users Warned of Fake Firmware Update Scam — Coinfomania","type":"news_article","url":"https://coinfomania.com/ledger-users-warned-of-fake-firmware-update-scam/"},{"credibility":2,"name":"Ledger, Again: Another Attack, Another Phishing Wave — U.Today","type":"news_article","url":"https://u.today/ledger-again-another-attack-another-phishing-wave-how-can-users-protect-themselves"},{"credibility":2,"name":"Slow Fog: Beware of Phishing Activities — ChainCatcher","type":"news_article","url":"https://www.chaincatcher.com/en/article/2296800"}]},{"content":"The October 2026 campaign is not the first phishing operation targeting Ledger users. Prior documented campaigns include a large-scale email phishing wave following Ledger's 2020 customer database breach, which exposed physical addresses and phone numbers of approximately 272,000 customers and email addresses of approximately 1 million customers, enabling highly targeted follow-on attacks. Physical mail phishing campaigns impersonating Ledger with printed letters containing QR codes have also been documented, directing victims to seed-phrase harvesting pages. The August 2026 Google Ads-based campaign documented by Zscaler preceded the October firmware update campaign. The recurring nature of these attacks reflects the high value of Ledger's user base as a target population of hardware wallet owners with on-chain assets.","heading":"Historical Context: Prior Ledger Phishing Waves","severity":"medium","sources":[{"credibility":2,"name":"Scammers Send Physical Phishing Letters to Steal Ledger Wallet Seed Phrases — HackRead","type":"news_article","url":"https://hackread.com/scammers-physical-phishing-letters-ledger-wallet-seed/"},{"credibility":2,"name":"New Ledger Phishing Campaign Targets Recovery Phrases — GridinSoft Blog","type":"news_article","url":"https://blog.gridinsoft.com/ledger-phishing-campaign-recovery-phrases/"},{"credibility":1,"name":"Attackers Target Ledger Users Via Google Ads — Zscaler ThreatLabz","type":"research","url":"https://www.zscaler.com/blogs/security-research/threat-actors-use-google-ads-target-ledger-users"}]}],"sources_used":[{"credibility":2,"name":"Fake Ledger Firmware Update Scam Exploits CryptoBilis Hack, SlowMist Warns — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/10/16/fake-ledger-firmware-update-scam-exploits-cryptobilis-hack-slowmist-warns/"},{"credibility":2,"name":"SlowMist: Fake Ledger Firmware Update Phishing Page Emerges — TechFlow","type":"news_article","url":"https://www.techflowpost.com/en-US/newsletter/140221"},{"credibility":2,"name":"SlowMist: Beware of Fake 'Ledger Firmware Update' Scams — TechFlow","type":"news_article","url":"https://www.techflowpost.com/en-US/newsletter/140229"},{"credibility":2,"name":"SlowMist Warns of Phishing Pages Impersonating Fake Ledger Firmware Updates — KuCoin News","type":"news_article","url":"https://www.kucoin.com/news/flash/slowmist-warns-of-fake-ledger-firmware-update-phishing-pages"},{"credibility":2,"name":"Fake Ledger Firmware Update Phishing Campaign Detected — Phemex News","type":"news_article","url":"https://phemex.com/news/article/fake-ledger-firmware-update-phishing-campaign-detected-amid-supply-chain-concerns-100125"},{"credibility":1,"name":"Attackers Target Ledger Users Via Google Ads — Zscaler ThreatLabz","type":"research","url":"https://www.zscaler.com/blogs/security-research/threat-actors-use-google-ads-target-ledger-users"},{"credibility":2,"name":"Threat Actors Use Google Ads To Target Ledger Users — Security Boulevard","type":"news_article","url":"https://securityboulevard.com/2026/09/threat-actors-use-google-ads-to-target-ledger-users/"},{"credibility":1,"name":"Ledger Finds Unauthorized Hardware Implant in CryptoBilis-Sold Wallet — The Hacker News","type":"news_article","url":"https://thehackernews.com/2026/10/ledger-finds-unauthorized-hardware.html"},{"credibility":1,"name":"Ledger Says Unauthorized Implant Found in at Least One Device Sold by CryptoBilis — CoinDesk","type":"news_article","url":"https://www.coindesk.com/tech/2026/10/12/ledger-says-unauthorized-implant-found-in-at-least-one-device-sold-by-cryptobilis"},{"credibility":2,"name":"Ledger Faces Fake Website Warning Amid $86M Theft Probe — crypto.news","type":"news_article","url":"https://crypto.news/ledger-faces-fake-website-warning-amid-86m-theft-probe/"},{"credibility":2,"name":"Ledger Users Warned of Fake Firmware Update Scam — Coinfomania","type":"news_article","url":"https://coinfomania.com/ledger-users-warned-of-fake-firmware-update-scam/"},{"credibility":2,"name":"Ledger, Again: Another Attack, Another Phishing Wave — U.Today","type":"news_article","url":"https://u.today/ledger-again-another-attack-another-phishing-wave-how-can-users-protect-themselves"},{"credibility":2,"name":"Slow Fog: Beware of Phishing Activities — ChainCatcher","type":"news_article","url":"https://www.chaincatcher.com/en/article/2296800"},{"credibility":2,"name":"Scammers Send Physical Phishing Letters to Steal Ledger Wallet Seed Phrases — HackRead","type":"news_article","url":"https://hackread.com/scammers-physical-phishing-letters-ledger-wallet-seed/"},{"credibility":2,"name":"New Ledger Phishing Campaign Targets Recovery Phrases — GridinSoft Blog","type":"news_article","url":"https://blog.gridinsoft.com/ledger-phishing-campaign-recovery-phrases/"},{"credibility":2,"name":"Ledger CryptoBilis Hack Drains $92.9M, 311 Wallets — Shattered.io","type":"news_article","url":"https://shattered.io/ledger-cryptobilis-hack-92-9-million-2026/"},{"credibility":2,"name":"Fake Ledger Websites Rank Highly on Google Searches — KuCoin News","type":"news_article","url":"https://www.kucoin.com/news/flash/fake-ledger-websites-rank-high-on-google-search-users-warned-of-mnemonic-phrase-phishing-risks"}],"summary":"In October 2026, security firm SlowMist identified a phishing campaign targeting Ledger hardware wallet users through fraudulent firmware update notifications. The campaign opportunistically exploited user anxiety following the separately documented CryptoBilis supply chain incident, directing victims to counterfeit 'Genuine Check' verification pages designed to harvest 24-word Secret Recovery Phrases. The attack is distinct from the CryptoBilis hardware implant incident but shares its victims and timing.","timeline":[{"date":"2020-07-01","event":"Ledger customer database breach exposes email addresses of approximately 1 million customers and personal data of approximately 272,000 customers, enabling targeted phishing campaigns in subsequent years.","source":"GridinSoft Blog","source_url":"https://blog.gridinsoft.com/ledger-phishing-campaign-recovery-phrases/"},{"date":"2026-08-01","event":"Zscaler ThreatLabz begins analysis of a Google Ads-based phishing campaign targeting Ledger users in the US, Europe, and Asia, using a multi-stage redirect chain through Google Cloud Storage, Vercel, and Google Sites.","source":"Zscaler ThreatLabz","source_url":"https://www.zscaler.com/blogs/security-research/threat-actors-use-google-ads-target-ledger-users"},{"date":"2026-09-25","event":"Zscaler ThreatLabz publishes detailed investigation of the Google Ads-based Ledger phishing campaign, classifying the signature as HTML.Phish.Ledger and documenting infrastructure including attacker-controlled Vercel endpoints and Google Sites pages.","source":"Security Boulevard / Zscaler ThreatLabz","source_url":"https://securityboulevard.com/2026/09/threat-actors-use-google-ads-to-target-ledger-users/"},{"date":"2026-10-09","event":"Ledger discloses an active investigation into reports of stolen cryptocurrency linked to Southeast Asian reseller CryptoBilis; the company requests a sales suspension for CryptoBilis.","source":"CoinDesk","source_url":"https://www.coindesk.com/tech/2026/10/12/ledger-says-unauthorized-implant-found-in-at-least-one-device-sold-by-cryptobilis"},{"date":"2026-10-10","event":"Security researcher Cyber Scrilla identifies a new fake Ledger website appearing in search results, coinciding with the CryptoBilis news cycle.","source":"crypto.news","source_url":"https://crypto.news/ledger-faces-fake-website-warning-amid-86m-theft-probe/"},{"date":"2026-10-12","event":"Ledger confirms an unauthorized hardware implant was found in at least one device sold by CryptoBilis. The implant captured 24-word recovery phrases during device setup via an embedded eSIM transmitting over LTE.","source":"The Hacker News / CoinDesk","source_url":"https://thehackernews.com/2026/10/ledger-finds-unauthorized-hardware.html"},{"date":"2026-10-16","event":"SlowMist publicly warns of the fake firmware update phishing campaign, documenting counterfeit 'Genuine Check' pages designed to harvest Secret Recovery Phrases from users alarmed by the CryptoBilis incident.","source":"CryptoTimes / TechFlow / KuCoin News / Phemex","source_url":"https://www.cryptotimes.io/2026/10/16/fake-ledger-firmware-update-scam-exploits-cryptobilis-hack-slowmist-warns/"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision e6e837f4-3673-4d4d-b6c2-05c4b6d91005copy