This report concerns an active phishing infrastructure impersonating Ledger and Ledger Live.
The phishing campaign uses the following domains:
The websites imitate the official Ledger interface, including device selection and wallet connection pages, to trick victims into entering their 24-word recovery phrase and other sensitive wallet credentials.
The stolen credentials are used to compromise cryptocurrency wallets and steal digital assets. One of the phishing domains is also indexed by search engines, increasing user exposure and the risk of additional victims.
These domains are not affiliated with Ledger and exist solely for credential harvesting, cryptocurrency theft, and financial fraud.
Please investigate and remove any related malicious content or infrastructure as soon as possible.
This report concerns an active phishing infrastructure impersonating Ledger and Ledger Live.
The phishing campaign uses the following domains:
The websites imitate the official Ledger interface, including device selection and wallet connection pages, to trick victims into entering their 24-word recovery phrase and other sensitive wallet credentials.
The stolen credentials are used to compromise cryptocurrency wallets and steal digital assets. One of the phishing domains is also indexed by search engines, increasing user exposure and the risk of additional victims.
These domains are not affiliated with Ledger and exist solely for credential harvesting, cryptocurrency theft, and financial fraud.
Please investigate and remove any related malicious content or infrastructure as soon as possible.