Fake Ledger “Firmware Update” Phish Spreads

Scammers are exploiting fear from a recent Ledger-related spyware incident by sending emails that push a fake “firmware update.” The email urges recipients to connect their hardware wallet and click through to a realistic-looking “Genuine check” page with an “Update Now” button, risking theft if victims follow the instructions or reveal their recovery phrase.

Key findings

• A real-world phishing campaign is using a fake “Ledger firmware update” message to exploit panic around an $86M Ledger spyware incident.
• The lure tells recipients to connect their hardware wallet to “protect your device against emerging spyware threats,” referencing “recent incidents in Malaysia.”
• The phishing flow reportedly includes a realistic fake “Genuine check” page, device selection, and an “Update Now” button.
• The warning highlights the likely end goal: trick users into clicking update links and entering their wallet recovery phrase (seed phrase).

Who’s being targeted

• Commonly targeted roles: Finance, Executives, Employees managing corporate crypto assets, Security awareness training audience (all staff with access to company funds/accounts).
• Affected industries: Cryptocurrency/Blockchain, Financial services (consumer financial assets), Retail consumers/individual investors.
• Attack channels: email, website.
• Impersonated: Ledger (or Ledger Support).

Awareness takeaways

• Treat “security update” emails as suspicious, verify updates only through the official product/app workflow, not emailed links.
• Never enter or share wallet recovery phrases/seed phrases, any request for it should be treated as an attempted theft.
• Be extra cautious during high-profile incidents; attackers often exploit panic and breaking news to increase click-through rates.

Red flags to watch for

• Creates urgency/fear by referencing a high-profile incident and “emerging spyware threats.”
• Pushes the user to use website links/buttons for an update rather than the official app/update process.
• Any request to enter a recovery phrase is a strong indicator of fraud.