Search for Ledger and the top result may not be Ledger. Zscaler ThreatLabz researcher Prakhar Shrotriya has documented a phishing campaign, analysed in August 2026, that bought Google search ads for Ledger-related terms and walked hardware wallet owners through a fake device check that ends with them typing in their secret recovery phrase. With that phrase, an attacker can restore the wallet in compatible software and move the funds without ever touching the physical device.
The ads were aimed at users in the United States, Europe and parts of Asia. They also looked unusually trustworthy.
A verified advertiser and a borrowed visit count
The ads ran under a long-standing, Google-verified advertiser account, listed with a location in Germany and with no observed history of malicious ads, which ThreatLabz says the threat actor may have compromised. The ad displayed google.com and a line claiming "10L+ visits in the past month" ("10L" is one million in Indian numbering). That figure appears to refer to google.com rather than the phishing destination, and may have made the ad look more credible.
Google and Vercel infrastructure at every hop
A click led to a Google Cloud Storage URL, which redirected to a Vercel-hosted page, which in turn sent the visitor to a Google Sites page that displayed the phishing site inside an iframe. The phishing content itself was also served from Vercel domains. During the analysis, the Vercel domain in the JavaScript redirect changed roughly every 15 to 20 minutes, which makes blocking by domain reputation harder, while the same Cloud Storage page stayed in use.
The fake site copied Ledger's interface and offered app downloads for Windows, macOS, Linux and mobile devices. It also collected device metadata and tracked keypresses, touches and mouse movements, sending them to a Vercel-hosted endpoint, which ThreatLabz says could let the operators tell real visitors from automated analysis tools. A Cloudflare Web Analytics beacon was embedded as well.
A fake firmware update that asks for the seed
After choosing a device, the victim saw messages such as "Connecting your Ledger" and "Initializing Firmware Update", was told the device was connected, and was asked to confirm ownership by entering the recovery phrase. The page loaded the standard 2,048-word BIP-39 English wordlist to autocomplete each field, the kind of polish that makes a form feel like real wallet software. The first submission went straight to an attacker-controlled Vercel domain, and the page then claimed the seed was invalid and asked for it again. The second submission was sent too, before the victim was bounced back to the landing page. ThreatLabz did not observe any server-side logic comparing the two entries.
Never type a recovery phrase into a web page
A recovery phrase exists to restore a wallet, not to verify a device, so any website or pop-up that asks for it should be treated as a scam. Ledger owners are safer reaching the vendor's software through a bookmarked or typed address than through a search ad. Anyone who has already entered their phrase on a page like this should assume the wallet is compromised and move funds to a new wallet with a freshly generated phrase.
Indicators (defanged): Cloud Storage buckets storage[.]googleapis[.]com/apf-leg-ad-23798/ and storage[.]googleapis[.]com/ledg-leg1-79230/; Google Sites pages sites[.]google[.]com/view/start-ledger-wallet and sites[.]google[.]com/view/download-ledger-wallet-pc; Vercel domains rpc-gbz5[.]vercel[.]app, router-wdoi[.]vercel[.]app and node-f1ey[.]vercel[.]app. Zscaler detects the page as HTML.Phish.Ledger.
Search ads have become a favourite front door for this kind of fraud, as an earlier campaign abusing ads for AI tools showed. What stands out here is that every hop, from the ad to the final page, sat on a platform people are taught to trust.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.