# Malicious Google Ads Campaign Targets Ledger Hardware Wallet Users to Steal BIP-39 Recovery Phrases via Google Cloud Storage / Vercel / Google Sites Redirect Chain

> Since at least August 2026, threat actors have run fraudulent Google Ads impersonating Ledger that route victims through Google Cloud Storage buckets and rotating Vercel-hosted redirects to a Google Sites page hosting a fake device-verification interface with BIP-39 wordlist autocomplete, tricking victims into typing their Secret Recovery Phrase and allowing wallets to be drained without the physical device. Zscaler ThreatLabz publicly flagged the active campaign in late August 2026 and published full technical analysis on September 25, 2026 (detection name HTML.Phish.Ledger), corroborated the same day by an independent Security Boulevard mirror with matching indicators.

- **Published:** 2026-09-26T00:00:00Z
- **Last reviewed:** 2026-09-26T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2673
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-ledger-seed-phrase-phishing-tl-2026-2673.webp?v=8da965f0 (Threadlinqs threat intel: Ledger Seed-Phrase Phishing via Google Ads: Detection & IOCs (TL-2026-2673) — High severity, 19 IOCs, 9 detection rules.)
- **ID:** TL-2026-2673
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 19

## Description

Threat actors are abusing a chain of entirely legitimate, trusted cloud services — Google Ads, Google Cloud Storage (GCS), Vercel, and Google Sites — to deliver a credential-phishing page targeting Ledger hardware wallet users. The campaign is run through what Zscaler ThreatLabz describes as a 'long-standing, verified advertiser account' registered in Germany that researchers assess may itself have been compromised rather than newly fraudulently created, letting the ads inherit Google's trust signals (the ad displayed 'google.com' as its destination and boasted '10L+ visits in the past month'). Victims searching for Ledger-related terms in the United States, Europe, and parts of Asia are served the sponsored ad; clicking it sends them through a GCS bucket (e.g. storage.googleapis.com/apf-leg-ad-23798/), then to a Vercel-hosted intermediate application whose subdomain rotates every 15-20 minutes (observed values include soyyoo-cwpc5n0e.vercel.app, rpc-gbz5.vercel.app, whyavc-qwmv6stx.vercel.app, router-wdoi.vercel.app, and node-f1ey.vercel.app), and finally to a Google Sites page (e.g. sites.google.com/view/start-ledger-wallet) whose visible URL inherits Google's own domain, embedding the actual phishing interface inside an iframe served from the Vercel origin.

The phishing interface closely mimics Ledger's official device-setup workflow: it prompts the victim to select a device type (Windows, macOS, Linux, mobile), plays simulated progress messages ('Connecting your Ledger,' 'Initializing Firmware Update'), asks for device-ownership confirmation, and then prompts for the 24-word Secret Recovery Phrase (SRP). To increase the illusion of legitimacy and completion rate, the page fetches the full 2,048-word BIP-39 English wordlist from a bundled endpoint (api/bip39-english.txt) and implements live autocomplete as the victim types each word — the same UX behavior as Ledger's genuine tooling. The kit captures the recovery phrase twice: after the first submission it displays a fake 'Invalid seed. Please re-enter your recovery phrase carefully' error to harvest a second, corroborating entry before redirecting the victim to a benign-looking landing page, reducing suspicion. Throughout the flow the page monitors keypresses, touches, and mouse movement, and loads an invisible-mode hCaptcha widget at submission time — both used to fingerprint and filter out automated security-scanner traffic rather than real victims, extending the infrastructure's operational lifetime against takedown/scanning efforts. Captured recovery phrases are POSTed to the attacker-controlled Vercel backend.

Because a BIP-39 Secret Recovery Phrase is the master key material for a hardware wallet, possession of it lets an attacker restore the wallet in any compatible software and drain all associated cryptocurrency holdings without ever needing physical access to the victim's Ledger device. No CVE or software vulnerability is involved — the entire chain is social engineering built on abuse of legitimate advertising and hosting platforms (malvertising, GCS, Vercel, Google Sites) to evade URL-reputation and brand-protection filters that would flag a directly-registered lookalike domain.

## MITRE ATT&CK

- T1583.008 Malvertising
- T1583.006 Web Services
- T1586.003 Cloud Accounts
- T1608.005 Link Target
- T1204.001 Malicious Link
- T1036.005 Match Legitimate Resource Name or Location
- T1497.002 User Activity Based Checks
- T1684.001 Impersonation
- T1552.004 Private Keys
- T1102.002 Bidirectional Communication
- T1071.001 Web Protocols
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**BIP-39 Wordlist Fetch and Fake Device-Verification Credential Harvest** (`TL-2026-2673-SPL-002`)

Detects a browser fetching the 2,048-word BIP-39 English wordlist (/api/bip39-english.txt) from non-ledger.com infrastructure, or submitting form data matching seed/recovery-phrase field patterns to a *.vercel.app or Google Sites origin. This is the exact mechanism the HTML.Phish.Ledger kit uses to power its fake 'Connecting your Ledger' / 'Initializing Firmware Update' device-verification flow and harvest the victim's 24-word Secret Recovery Phrase (captured twice via a fake 'Invalid seed' re-prompt).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1036.005, T1656, T1552.004, T1497.002
- **Data sources:** web_proxy, zscaler_nss, http_logs
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=proxy (sourcetype=zscalernss-web OR sourcetype=squid:access)
| eval indicator=case(
    match(url, "\/api\/bip39-english\.txt"), "bip39_wordlist_fetch",
    (http_method="POST" AND match(url, "\.vercel\.app") AND match(url, "(?i)(seed|recovery|mnemonic|srp)")), "credential_post",
    1=1, "other")
| where indicator!="other" AND NOT match(url, "(?i)ledger\.com")
| stats earliest(_time) as first_seen, latest(_time) as last_seen, count by src_ip, user, dest, url, indicator
| eval risk_score=if(indicator="credential_post", 95, 80)
| sort - last_seen
```

### Microsoft KQL

```kql
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteUrl has "/api/bip39-english.txt"
    or (RemoteUrl has ".vercel.app" and RemoteUrl has_any ("seed", "recovery", "mnemonic", "srp"))
| where RemoteUrl !has "ledger.com"
| summarize FirstSeen = min(Timestamp), LastSeen = max(Timestamp), HitCount = count() by DeviceName, DeviceId, RemoteUrl, InitiatingProcessFileName
| extend RiskScore = iff(RemoteUrl has_any ("seed", "recovery", "mnemonic", "srp"), 95, 80)
| project FirstSeen, LastSeen, DeviceName, DeviceId, RemoteUrl, InitiatingProcessFileName, HitCount, RiskScore
```

### Sigma

```yaml
title: BIP-39 Wordlist Fetch or Recovery-Phrase Submission to Non-Ledger Phishing Infrastructure
id: 5f2c8b19-3d7e-4a1c-9b5f-7e2d4c8a6f13
status: experimental
description: Detects a browser fetching the 2048-word BIP-39 English wordlist (api/bip39-english.txt) or POSTing seed/recovery-phrase form data to attacker-controlled Vercel/Google Sites infrastructure, powering the fake Secret Recovery Phrase capture on the HTML.Phish.Ledger phishing kit.
references:
    - https://www.zscaler.com/blogs/security-research/threat-actors-use-google-ads-target-ledger-users
author: Threadlinqs Team
date: 2026-09-26
tags:
    - attack.defense-evasion
    - attack.t1036.005
    - attack.t1656
    - attack.t1497.002
    - attack.credential-access
    - attack.t1552.004
logsource:
    category: proxy
detection:
    sel_wordlist:
        cs-uri-stem|contains: '/api/bip39-english.txt'
    sel_post:
        cs-method: 'POST'
        cs-uri-stem|contains: '.vercel.app'
        cs-uri-query|contains:
            - 'seed'
            - 'recovery'
            - 'mnemonic'
    filter_ledger:
        cs-host|contains: 'ledger.com'
    condition: (sel_wordlist or sel_post) and not filter_ledger
falsepositives:
    - Legitimate Ledger Live desktop/mobile application or genuine ledger.com pages fetching the same wordlist (excluded via filter_ledger); confirm destination host is not ledger.com before escalating
level: critical

```

**Known false positives:**

- The genuine Ledger Live application or ledger.com itself may fetch the same BIP-39 wordlist file; exclude any hit whose host is ledger.com before alerting

**Tuning notes:** The /api/bip39-english.txt path is highly specific to this kit — treat any non-ledger.com hit as high-confidence and prioritize for immediate user contact/wallet-migration guidance; expand the seed/recovery/mnemonic keyword list if the kit's form field names change in future rotations.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Ledger Malvertising Multi-Hop Redirect Chain (GCS → Vercel → Google Sites) (locked: unlock with TL Creds)
- BIP-39 Wordlist Fetch and Fake Device-Verification Credential Harvest (locked: unlock with TL Creds)
- Recovery-Phrase Exfiltration via Rotating Vercel C2 Backend (locked: unlock with TL Creds)
- Ledger Malvertising Multi-Hop Redirect Chain (GCS → Vercel → Google Sites) (locked: unlock with TL Creds)
- BIP-39 Wordlist Fetch and Fake Device-Verification Credential Harvest (locked: unlock with TL Creds)
- Recovery-Phrase Exfiltration via Rotating Vercel C2 Backend (locked: unlock with TL Creds)
- Ledger Malvertising Multi-Hop Redirect Chain (GCS → Vercel → Google Sites) (locked: unlock with TL Creds)
- Recovery-Phrase Exfiltration via Rotating Vercel C2 Backend (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Threat Actors Use Google Ads To Target Ledger Users](https://www.zscaler.com/blogs/security-research/threat-actors-use-google-ads-target-ledger-users)
- [Threat Actors Use Google Ads To Target Ledger Users (mirror)](https://securityboulevard.com/2026/09/threat-actors-use-google-ads-to-target-ledger-users/)
- [Threat Actors Use Google Ads To Target Ledger Users (syndicated repost)](https://malware.news/t/threat-actors-use-google-ads-to-target-ledger-users/125906)
- [Ledger Phishing Scam: Fake Wallet Website Targets Crypto Users](https://bitcoinfoundation.org/news/crypto-companies-news/ledger-phishing-scam/)
- [Ongoing phishing campaigns | Ledger](https://www.ledger.com/phishing-campaigns-status)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2673