Phishing Scammers Exploit Ledger Spyware Scare With Fake Firmware Emails

A new phishing campaign is exploiting the panic surrounding reports of spyware-laden Ledger hardware wallets, with scammers sending fake firmware update emails designed to trick users into handing over their recovery phrases, security firm SlowMist has warned.

SlowMist shared screenshots of the phishing email, which invites recipients to connect their hardware wallet to protect it from spyware threats. The campaign includes a fake authenticity verification page, a step asking users to select their device model, and a button prompting an update. The structure mimics legitimate Ledger communications closely enough to catch out users who are already on edge following recent security incidents.

According to the brief, this particular phishing operation does not currently appear among the campaigns listed by Ledger on its own website, meaning users checking against the company's official warnings would not find it flagged there. Security researchers reiterated the standard precautions: do not click links in emails promising updates, and never enter a recovery phrase on a website.

The CryptoBilis incident

The scam follows reports of mass draining of Ledger devices linked to CryptoBilis, an authorised reseller operating in Southeast Asia. Mark Karpelès, the former CEO of Mt. Gox, said he had found devices allegedly containing spyware capable of accessing the screen and transmitting information via a hidden SIM card. The incident is estimated to have caused losses of around $86 million in cryptocurrencies.

In response, European distributor MediaMarkt suspended sales of the affected devices, and Ledger asked other resellers to do the same while the situation is investigated.

Pricing scrutiny for the Atom

The timing has not helped Ledger's public image. The company is facing criticism over the launch of its new Atom device, priced at $849, with the figure drawing attention at a moment when the brand's reputation for device security is already under strain from the CryptoBilis fallout and the wave of phishing attempts it has triggered.

For European users, the episode underscores a familiar pattern: genuine security incidents create fertile ground for opportunistic fraud. With a major reseller's devices implicated in an eight-figure theft, and distributors such as MediaMarkt pulling stock as a precaution, scammers have moved quickly to repackage the resulting anxiety into a new vector for stealing recovery phrases directly from worried owners.