Phishing attempts targetting Ledger wallet owners

avatar
(Edited)

image.png

Smishing (SMS Phishing)

There have been several reports on twitter and other website of phishing attempts that explicitly target Ledger holders.
People write they have been receiving messages about their hardware wallet being deactivated and that verification is needed.



image.png
(Screenshot from @Deanmcdonald23 Tweet)

The URL seems to redirect to Ledger.com, but if you click the link you will be redirected to the phishing website where you are asked to fill in your 24 word passphrase.
When you enter your passphrase the criminals will be able to withdraw the content of your ledger without needing physical access to it.

Multiple Twitter accounts are warning for this attack.


image.png

Email attacks

Apart from these SMS attacks there's also still a lot of phishing attempts via email. The aforementioned account XRP Forensics mentions over 20 victions in two days.
image.png

How do they know?

But how do these cybercriminals know who owns a Ledger and how did they get their emailaddress and phone number?
The following person Is asking the same in a Reddit post:


image.png


The answer is simple but disturbing. Last summer the Ledger company reported that 1 million email addresses and 9500 detailed personal information was accessible online.
A researcher in the Bounty Program found the leak which was patched immediately. Ledger confirmed the incident and mentioned the payment information and crypto funds were safe.
https://www.ledger.com/addressing-the-july-2020-e-commerce-and-marketing-data-breach
It is not known how long this vulnerability was available, but according to these attacks someone did download all this information.



image.png

Be aware!

Phishing is still growing. The more we do business on the internet, the more there is to gain for criminals.
Never, really NEVER access your websites where you store finances (Exchanges, Paypal or other important stuff) via a link in an email or SMS you receive!
If you receive a notification which tells you to verify, change your password or requires you to log in to the website; Open a browser and type in the website itself. If they send out an important email, they must also mention something about it on their website.
Be careful and don't let them rob you!

Posted Using LeoFinance Beta



0
0
0.000
6 comments
avatar

pixresteemer_incognito_angel_mini.png
Bang, I did it again... I just rehived your post!
Week 35 of my contest just started...you can now check the winners of the previous week!
!BEER
3

0
0
0.000
avatar

Probably there is no better lesson (on how to not misuse your HD wallet seed, 12/24 words) than learning from your own mistakes.
I have learned this the hard way too, myself.
I was lucky to end up with rather moderate loss, just ~$2000 worth

My recommendation is :

For using your 12/24 words, typical suggestion "think twice" is not enough.
Think 10 times, 15 times. Consult 2-3 friends.
Be sure you understand what are those 24 words, understand it's power, and how it works.

Posted Using LeoFinance Beta

0
0
0.000
avatar

I have learned this the hard way too, myself.
I was lucky to end up with rather moderate loss, just ~$2000 worth

That isn't a moderate loss to a lot of people; ouch!

Be sure you understand what are those 24 words, understand it's power, and how it works.

Bitcoin and crypto is all over the news again, so that will attract a lot of people that are new to crypto and don't know how it works.
It's necessary to keep spreading the word :)

Posted Using LeoFinance Beta

0
0
0.000
avatar

Thanks a lot! I've reblogged the post :)
I think wallets should stress the importance of NEVER having your keys/words revealed to anyone)

Posted Using LeoFinance Beta

0
0
0.000