Zscaler ThreatLabz details Google Ads phishing campaign targeting Ledger users

Zscaler ThreatLabz has analysed a phishing campaign that used fraudulent Google ads to target Ledger hardware wallet users in the United States, Europe and parts of Asia. The ads ran under a long-standing verified advertiser account with no prior history of malicious activity, which the researchers suggest may have been compromised.

Clicking an ad sent users through a Google Cloud Storage URL to a Vercel-hosted page and then to a Google Sites page that displayed a fake Ledger interface in an iframe. The Vercel redirect domain appeared to change roughly every 15 to 20 minutes during the analysis.

The fake page mimicked a device-verification process and prompted users to enter their secret recovery phrases, which were sent to an attacker-controlled Vercel endpoint. Zscaler said its cloud security platform detects indicators from the campaign.