Attackers Target Ledger Users Via Google Ads

The report documents a phishing campaign that used malicious Google ads and a chain of redirects (Google Cloud Storage → Vercel → Google Sites) to host a Ledger-impersonating page which collected device metadata, user interactions, and ultimately users' BIP-39 secret recovery phrases via attacker-controlled Vercel endpoints; the campaign used rotating domains, invisible hCaptcha, and analytics beacons to evade detection and capture multiple submissions of seeds for exfiltration.