Skip to content
Phishing Campaign Exploits Ledger Firmware Update Confusion

Phishing Campaign Exploits Ledger Firmware Update Confusion

First seen 16 Oct 2026, 13:38 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 16, 2026 at 13:39 UTC
  • •A phishing campaign is impersonating Ledger firmware updates.
  • •Users are advised to avoid clicking links in emails for updates.
  • •Scammers are exploiting recent security incidents to deceive users.

Following the October 9 CryptoBilis incident, SlowMist has issued a warning about a phishing campaign impersonating Ledger firmware updates. Scammers are sending emails that appear to be from Ledger, urging users to click on links for essential updates. The fraudulent emails include a polished design and a fake 'Genuine check' page that prompts users for their recovery phrases. Affected devices include Nano S Plus, Nano X, Flex, Stax, and Nano Gen5. Users are advised to avoid clicking links in emails for firmware updates and to treat any compromised recovery phrases as a sign of wallet compromise. The campaign exploits the urgency created by recent security incidents, making it particularly deceptive. SlowMist emphasizes that legitimate updates should only be conducted through the official Ledger Live app.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 2h ago How this analysis works

Timeline

2026-10-09
CryptoBilis incident occurs
A supply chain incident involving Ledger leads to increased security concerns among users.
U.Today
2026-10-16
SlowMist issues phishing alert
SlowMist warns of a phishing campaign exploiting Ledger's recent supply chain incident, urging users to avoid fraudulent links.
Kucoin

More articles in this cluster (3)

Following this threat?

Track Ledger in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (7)

1 / 3

Common questions

What should users do if they clicked a phishing link?
Users should treat their wallet as compromised and move funds to a new device with a fresh seed.
How can users verify legitimate firmware updates?
Firmware updates should only be performed through the official Ledger Live app, not via email links.
What devices are targeted by this phishing campaign?
The phishing campaign targets Ledger Nano S Plus, Nano X, Flex, Stax, and Nano Gen5 devices.