Malicious Google Ads Campaign Targets Ledger Hardware Wallet Users to Steal BIP-39 Recovery Phrases via Google Cloud Storage / Vercel / Google Sites Redirect Chain

Key facts

Detection coverage

As of 2026-09-26, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2673 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: BIP-39 Wordlist Fetch and Fake Device-Verification Credential Harvest

Detects a browser fetching the 2,048-word BIP-39 English wordlist (/api/bip39-english.txt) from non-ledger.com infrastructure, or submitting form data matching seed/recovery-phrase field patterns to a *.vercel.app or Google Sites origin. This is the exact mechanism the HTML.Phish.Ledger kit uses to power its fake 'Connecting your Ledger' / 'Initializing Firmware Update' device-verification flow and harvest the victim's 24-word Secret Recovery Phrase (captured twice via a fake 'Invalid seed' re-prompt).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1036.005, T1656, T1552.004, T1497.002
• Data sources: web_proxy, zscaler_nss, http_logs
• Severity: critical
• Confidence: high

Splunk SPL

index=proxy (sourcetype=zscalernss-web OR sourcetype=squid:access)
| eval indicator=case(
    match(url, "\/api\/bip39-english\.txt"), "bip39_wordlist_fetch",
    (http_method="POST" AND match(url, "\.vercel\.app") AND match(url, "(?i)(seed|recovery|mnemonic|srp)")), "credential_post",
    1=1, "other")
| where indicator!="other" AND NOT match(url, "(?i)ledger\.com")
| stats earliest(_time) as first_seen, latest(_time) as last_seen, count by src_ip, user, dest, url, indicator
| eval risk_score=if(indicator="credential_post", 95, 80)
| sort - last_seen

Microsoft KQL

DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteUrl has "/api/bip39-english.txt"
    or (RemoteUrl has ".vercel.app" and RemoteUrl has_any ("seed", "recovery", "mnemonic", "srp"))
| where RemoteUrl !has "ledger.com"
| summarize FirstSeen = min(Timestamp), LastSeen = max(Timestamp), HitCount = count() by DeviceName, DeviceId, RemoteUrl, InitiatingProcessFileName
| extend RiskScore = iff(RemoteUrl has_any ("seed", "recovery", "mnemonic", "srp"), 95, 80)
| project FirstSeen, LastSeen, DeviceName, DeviceId, RemoteUrl, InitiatingProcessFileName, HitCount, RiskScore

Sigma

title: BIP-39 Wordlist Fetch or Recovery-Phrase Submission to Non-Ledger Phishing Infrastructure
id: 5f2c8b19-3d7e-4a1c-9b5f-7e2d4c8a6f13
status: experimental
description: Detects a browser fetching the 2048-word BIP-39 English wordlist (api/bip39-english.txt) or POSTing seed/recovery-phrase form data to attacker-controlled Vercel/Google Sites infrastructure, powering the fake Secret Recovery Phrase capture on the HTML.Phish.Ledger phishing kit.
references:
    - https://www.zscaler.com/blogs/security-research/threat-actors-use-google-ads-target-ledger-users
author: Threadlinqs Team
date: 2026-09-26
tags:
    - attack.defense-evasion
    - attack.t1036.005
    - attack.t1656
    - attack.t1497.002
    - attack.credential-access
    - attack.t1552.004
logsource:
    category: proxy
detection:
    sel_wordlist:
        cs-uri-stem|contains: '/api/bip39-english.txt'
    sel_post:
        cs-method: 'POST'
        cs-uri-stem|contains: '.vercel.app'
        cs-uri-query|contains:
            - 'seed'
            - 'recovery'
            - 'mnemonic'
    filter_ledger:
        cs-host|contains: 'ledger.com'
    condition: (sel_wordlist or sel_post) and not filter_ledger
falsepositives:
    - Legitimate Ledger Live desktop/mobile application or genuine ledger.com pages fetching the same wordlist (excluded via filter_ledger); confirm destination host is not ledger.com before escalating
level: critical

Known false positives:

• The genuine Ledger Live application or ledger.com itself may fetch the same BIP-39 wordlist file; exclude any hit whose host is ledger.com before alerting

Tuning notes: The /api/bip39-english.txt path is highly specific to this kit — treat any non-ledger.com hit as high-confidence and prioritize for immediate user contact/wallet-migration guidance; expand the seed/recovery/mnemonic keyword list if the kit's form field names change in future rotations.

• 🔒 Ledger Malvertising Multi-Hop Redirect Chain (GCS → Vercel → Google Sites) · unlock with TL Creds
• 🔒 BIP-39 Wordlist Fetch and Fake Device-Verification Credential Harvest · unlock with TL Creds
• 🔒 Recovery-Phrase Exfiltration via Rotating Vercel C2 Backend · unlock with TL Creds
• 🔒 Ledger Malvertising Multi-Hop Redirect Chain (GCS → Vercel → Google Sites) · unlock with TL Creds
• 🔒 BIP-39 Wordlist Fetch and Fake Device-Verification Credential Harvest · unlock with TL Creds
• 🔒 Recovery-Phrase Exfiltration via Rotating Vercel C2 Backend · unlock with TL Creds
• 🔒 Ledger Malvertising Multi-Hop Redirect Chain (GCS → Vercel → Google Sites) · unlock with TL Creds
• 🔒 Recovery-Phrase Exfiltration via Rotating Vercel C2 Backend · unlock with TL Creds

Indicators of compromise

As of 2026-09-26, Threadlinqs Intelligence tracks 19 indicators of compromise for TL-2026-2673.

Technical analysis

Zscaler ThreatLabz publicly flagged the active campaign in late August 2026 and published full technical analysis on September 25, 2026 (detection name HTML.Phish.Ledger), corroborated the same day by an independent Security Boulevard mirror with matching indicators.

Threat actors are abusing a chain of entirely legitimate, trusted cloud services — Google Ads, Google Cloud Storage (GCS), Vercel, and Google Sites — to deliver a credential-phishing page targeting Ledger hardware wallet users. The campaign is run through what Zscaler ThreatLabz describes as a 'long-standing, verified advertiser account' registered in Germany that researchers assess may itself have been compromised rather than newly fraudulently created, letting the ads inherit Google's trust signals (the ad displayed 'google.com' as its destination and boasted '10L+ visits in the past month'). Victims searching for Ledger-related terms in the United States, Europe, and parts of Asia are served the sponsored ad; clicking it sends them through a GCS bucket (e.g. storage.googleapis.com/apf-leg-ad-23798/), then to a Vercel-hosted intermediate application whose subdomain rotates every 15-20 minutes (observed values include soyyoo-cwpc5n0e.vercel.app, rpc-gbz5.vercel.app, whyavc-qwmv6stx.vercel.app, router-wdoi.vercel.app, and node-f1ey.vercel.app), and finally to a Google Sites page (e.g. sites.google.com/view/start-ledger-wallet) whose visible URL inherits Google's own domain, embedding the actual phishing interface inside an iframe served from the Vercel origin.

The phishing interface closely mimics Ledger's official device-setup workflow: it prompts the victim to select a device type (Windows, macOS, Linux, mobile), plays simulated progress messages ('Connecting your Ledger,' 'Initializing Firmware Update'), asks for device-ownership confirmation, and then prompts for the 24-word Secret Recovery Phrase (SRP). To increase the illusion of legitimacy and completion rate, the page fetches the full 2,048-word BIP-39 English wordlist from a bundled endpoint (api/bip39-english.txt) and implements live autocomplete as the victim types each word — the same UX behavior as Ledger's genuine tooling. The kit captures the recovery phrase twice: after the first submission it displays a fake 'Invalid seed. Please re-enter your recovery phrase carefully' error to harvest a second, corroborating entry before redirecting the victim to a benign-looking landing page, reducing suspicion. Throughout the flow the page monitors keypresses, touches, and mouse movement, and loads an invisible-mode hCaptcha widget at submission time — both used to fingerprint and filter out automated security-scanner traffic rather than real victims, extending the infrastructure's operational lifetime against takedown/scanning efforts. Captured recovery phrases are POSTed to the attacker-controlled Vercel backend.

Because a BIP-39 Secret Recovery Phrase is the master key material for a hardware wallet, possession of it lets an attacker restore the wallet in any compatible software and drain all associated cryptocurrency holdings without ever needing physical access to the victim's Ledger device. No CVE or software vulnerability is involved — the entire chain is social engineering built on abuse of legitimate advertising and hosting platforms (malvertising, GCS, Vercel, Google Sites) to evade URL-reputation and brand-protection filters that would flag a directly-registered lookalike domain.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1036.005 Match Legitimate Resource Name or Location; T1497.002 User Activity Based Checks; T1684.001 Impersonation

Command and Control

T1071.001 Web Protocols; T1102.002 Bidirectional Communication

execution

T1204.001 Malicious Link

Credential Access

T1552.004 Private Keys

Resource Development

T1583.006 Web Services; T1583.008 Malvertising; T1586.003 Cloud Accounts; T1608.005 Link Target

Impact

T1657 Financial Theft

Remediation

Immediate actions

• Never enter a Ledger Secret Recovery Phrase (or any hardware-wallet seed phrase) into a website, browser extension, or desktop/mobile app screen — it should only ever be entered on the physical device itself
• Treat any 'device verification', 'firmware update', or 'synchronization' flow that asks for a recovery phrase in a browser as fraudulent and abandon it immediately
• Verify the destination of Ledger-branded ads and links independently by navigating directly to ledger.com rather than clicking sponsored search results or Google Sites/Vercel-hosted pages
• Report suspicious 'Ledger' Google Ads to Google Ads Safety and to Ledger's own phishing-report channel

Workarounds

• Only perform firmware updates and wallet setup/restoration through the official Ledger Live application downloaded directly from ledger.com, never through a browser flow reached via an ad or third-party link
• Bookmark ledger.com directly and disable/ignore sponsored search results when looking for Ledger support or software

Longer-term hardening

• Deploy brand-impersonation and typosquat/URL-monitoring coverage that also tracks abuse of legitimate SaaS hosting (storage.googleapis.com, *.vercel.app, sites.google.com) as phishing infrastructure, not just directly-registered lookalike domains
• Advertiser-account security hardening (mandatory MFA, anomalous-activity alerting, and ad-content review) to reduce the risk of verified accounts being hijacked and repurposed for malvertising
• User awareness training for cryptocurrency holders on multi-hop redirect chains that abuse trusted cloud platforms to bypass URL-reputation filtering

Affected and fixed versions

• Ledger — Ledger hardware wallet users / Ledger Live setup and device-verification workflow (impersonated, not a software vulnerability)
  Vulnerable versions: Not version-specific — social-engineering attack targets end users of any Ledger hardware wallet model
  Fixed in: Not applicable — no software vulnerability; mitigation is user awareness and takedown of phishing infrastructure

Timeline

• 2026-08-01 Zscaler ThreatLabz later assesses the malvertising campaign has been active since August 2026; users begin reporting sponsored 'Ledger Official' Google results appearing for searches like 'Ledger Wallet' (exact day within August not disclosed).
• 2026-08-27 A fake 'Invalid seed. Please re-enter your recovery phrase carefully' error forces victims to submit their recovery phrase a second time; both submissions are sent to the attacker-controlled Vercel backend (guarded by an invisible-mode hCaptcha and keypress/mouse-movement bot checks) before the victim is redirected to a benign-looking landing page.
• 2026-08-27 The Google Sites page embeds a phishing interface in an iframe that walks victims through fake device selection, simulated 'Connecting your Ledger'/'Initializing Firmware Update' messages, and a device-ownership confirmation prompt before requesting the Secret Recovery Phrase, using a fetched 2,048-word BIP-39 wordlist for live autocomplete.
• 2026-08-27 Victims clicking the fraudulent ad are routed through Google Cloud Storage bucket paths (e.g. locked-ioc-3) to rotating Vercel-hosted intermediate domains (e.g. locked-ioc-8, rotating every 15-20 minutes), then to a Google Sites page (e.g. locked-ioc-2) whose visible URL appears to belong to Google itself.
• 2026-08-27 Zscaler ThreatLabz publicly flags the active campaign, identifying it as abusing a compromised, verified Google Ads advertiser account to target Ledger Secret Recovery Phrases.
• 2026-08-31 Bitcoin Foundation publishes an independent write-up corroborating the campaign, citing Zscaler's August 27 disclosure and adding user-protection and recovery guidance.
• 2026-09-25 Zscaler assigns detection name HTML.Phish.Ledger (ID 4f9dc76e-38af-43a0-8161-4fe679cb310b) to the phishing kit; Security Boulevard and Malware News mirror the report the same day with matching indicators.
• 2026-09-25 Zscaler ThreatLabz (analyst Prakhar Shrotriya) publishes full technical analysis of the campaign, including the complete redirect-chain IOCs (GCS buckets, Vercel domains, Google Sites URLs).

Sources cited

• Ongoing phishing campaigns | Ledger ledger.com · Vendor report
• Threat Actors Use Google Ads To Target Ledger Users zscaler.com · Blog · 2026-09-25
• Threat Actors Use Google Ads To Target Ledger Users (mirror) securityboulevard.com · Blog · 2026-09-25
• Threat Actors Use Google Ads To Target Ledger Users (syndicated repost) malware.news · Blog · 2026-09-25
• Ledger Phishing Scam: Fake Wallet Website Targets Crypto Users bitcoinfoundation.org · News · 2026-08-31

More in phishing

• Utility Impostor Scams: Lookalike Domains, Scam Ads and Phishing-as-a-Service (Darcula V3) Targeting Utility Customers
• 110-Domain Fake Copyright-Strike (DMCA/YouTube) Phishing Estate Using Browser-in-the-Browser Google Credential Harvesting
• SkyW4lker-Associated Microsoft OAuth Phishing via Adobe-Hosted PDF Lure (slybee.com)
• Holiday Phishing Scams 2026: Black Friday-Themed Phishing, Quishing, Callback Fraud and BEC Targeting Employees
• BluePhishing: Initial Access via Third-Party Agent Blueprint Consent (Microsoft Entra Agent ID)

Previous and next in phishing

• Google Account Security Team Impersonation Vishing Campaign — Telegram Recruitment Ad Leaks Call Script Previous report
• OS-Aware Phishing Kit Fans Fake iCloud Alert into ScreenConnect RMM, Apple ID, and M365 AiTM Harvesters Next report

Further reading

• TeamPCP Supply Chain Attack on Trivy, LiteLLM