Attackers Target Ledger Users Via Google Ads | ThreatLabz
Fraudulent Google ads redirect Ledger hardware-wallet users through Google Cloud Storage and rotating Vercel domains to a phishing page that harvests cryptocurrency secret recovery phrases. A phishing campaign abuses Google's verified-advertiser system to place malicious ads for Ledger-related search terms. Clicks route through Google Cloud Storage buckets and rapidly rotating Vercel subdomains to a Google Sites page embedding a Ledger-impersonating iframe. The fake verification flow harvests BIP-39 secret recovery phrases and exfiltrates them to attacker-controlled Vercel endpoints, enabling full wallet takeover without the physical device.
Detection / Hunteropenrouter
Immediate Actions
- Block all listed GCS bucket URLs, Google Sites URLs, and Vercel domains at web gateway
- Report the fraudulent Google advertiser account to Google for takedown
- Alert Ledger user community about active Google Ads phishing via official channels
Key Takeaways
- Campaign active in August 2026; ads shown under a Google-verified advertiser profile based in Germany.
- Vercel redirect domains rotated approximately every 15-20 minutes to evade domain-reputation blocking.
- Phishing page fetched the 2,048-word BIP-39 English wordlist from its own server for autocomplete suggestions.
- Page collected device metadata and interaction telemetry to distinguish real users from analysis tools.
- Two recovery-phrase submissions were exfiltrated to an attacker-controlled Vercel endpoint; an hCaptcha widget ran in invisible mode during submission.
Attack Chain
- Initial Access: Malicious Google ads under verified advertiser profile target Ledger users in search results
- Redirect: GCS bucket URLs redirect users to rapidly rotating Vercel subdomains
- Delivery: Vercel page redirects to Google Sites page embedding Ledger phishing iframe
- Credential Harvest: Fake device-verification flow prompts user to enter BIP-39 recovery phrase with autocomplete
- Exfiltration: Two recovery-phrase submissions sent to attacker-controlled Vercel endpoint; user redirected to landing page
Affected Systems
- Ledger hardware wallet users on Windows
- Ledger hardware wallet users on macOS
- Ledger hardware wallet users on Linux
- Ledger hardware wallet users on mobile devices
- Users in United States, Europe, and Asia
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Low | Campaign is web-based social engineering; no executable or file-system artifacts on endpoint. |
| Network Visibility | High | Full redirect chain visible in web proxy, DNS, and HTTP logs. |
| Detection Difficulty | Hard | Legitimate infrastructure (Google, Vercel) with rotating subdomains every 15-20 minutes defeats static domain blocks. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| Google Sites pages embedding iframes that load content from recently created Vercel subdomains indicate credential phishing infrastructure (T1566.002). | Web proxy URL and referer logs | Initial Access | Medium — legitimate apps also use Vercel and Google Sites |
| Google Cloud Storage URLs with patterns matching 'apf-leg-ad-*' redirecting to Vercel domains indicate this campaign's redirect chain (T1566.002). | Web proxy redirect and DNS logs | Initial Access | Low — bucket naming pattern is campaign-specific |
| Web pages requesting a BIP-39 wordlist file from a relative path serve cryptocurrency wallet phishing interfaces (T1056.003). | Web proxy body or URL path logs | Credential Access | Low — legitimate wallet apps do not fetch BIP-39 lists server-side |
Required Log Sources
- Web proxy logs
- DNS resolution logs
- Google Workspace audit logs
- URL filtering logs
Key Behavioral Indicators
- Google Cloud Storage bucket URLs containing 'leg-ad' or 'leg' in path
- Google Sites URLs containing 'ledger' or 'wallet' in path with iframe content
- Vercel subdomains with random alphanumeric patterns used as redirect targets
- Web pages fetching api/bip39-english.txt from a relative server path
- Cloudflare beacon.min.js paired with hCaptcha invisible mode on non-Ledger domains
- JavaScript location.replace redirects from GCS buckets to Vercel domains
Control Gaps
- Static URL blocklists cannot keep up with 15-20 minute Vercel subdomain rotation
- Google verified-advertiser status bypasses ad-platform abuse checks
- Google Sites and Vercel are trusted domains bypassing URL reputation filters
False Positive Assessment
Medium — Google Sites, Google Cloud Storage, and Vercel are legitimate platforms; blocking by bare domain would cause false positives, but the specific bucket names, Google Sites paths, and Vercel subdomain patterns are campaign-specific and unlikely to appear in benign traffic.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Implement URL filtering for Google Sites pages embedding external iframes loading Vercel content
- Block or challenge Vercel subdomains registered within the last 24 hours
- Monitor Google Cloud Storage bucket names matching 'apf-leg-ad-' or 'leg-leg1-' patterns
User Protection
- Remind users that Ledger will never ask for recovery phrases on any website
- Advise users to bookmark Ledger.com and avoid clicking search ads for wallet software
- Enable browser anti-phishing and safe-browsing protections on all endpoints
Security Awareness
- Train users that hardware wallet recovery phrases must never be typed into web forms
- Educate users to verify ad destination URLs match official Ledger.com before clicking
MITRE ATT&CK Mapping
Initial Access
Execution
Credential Access
Plain-Language Summary
Attackers bought Google search ads that looked like official Ledger promotions and used a verified advertiser account. When people clicked the ad, they were sent through a chain of redirects to a fake Ledger website that asked them to enter their wallet recovery phrase — the secret words that control access to their cryptocurrency. Anyone who entered those words gave the attackers full access to their wallet. Ledger users should never enter recovery phrases on any website and should only download Ledger software from Ledger.com.
Additional IOCs
- Domains:
router-wdoi[.]vercel[.]app- Rotating Vercel domain serving phishing contentnode-f1ey[.]vercel[.]app- Rotating Vercel domain serving phishing contentwallet-lcbt[.]vercel[.]app- Vercel domain used in JavaScript redirect observed in HTMLgateway-ch96[.]vercel[.]app- Vercel domain used in JavaScript redirect observed in HTML
- Urls:
sites.google.com/view/downloads-ledger-wallet- Google Sites phishing page seen in images
- Other:
api/bip39-english.txt- BIP-39 wordlist path served from phishing host for autocomplete
- domaingateway-ch96[.]vercel[.]appVercel domain used in JavaScript redirect observed in HTML
- domainnode-f1ey[.]vercel[.]appRotating Vercel domain serving phishing content
- domainrouter-wdoi[.]vercel[.]appRotating Vercel domain serving phishing content
- domainrpc-gbz5[.]vercel[.]appRotating Vercel domain serving phishing content and exfiltration
- domainsoyyoo-cwpc5n0e[.]vercel[.]appRotating Vercel domain serving phishing content and exfiltration
- domainwallet-lcbt[.]vercel[.]appVercel domain used in JavaScript redirect observed in HTML
- domainwhyavc-qwmv6stx[.]vercel[.]appRotating Vercel domain serving phishing content and exfiltration