Loading story…
Threat actors used punycode and other lookalike domains to impersonate Ledger and target cryptocurrency users after the company's customer data breach became public. Proofpoint reported thousands of phishing emails directing victims to a spoofed Ledger site that offered trojanized Ledger Live installers for Windows, macOS, and Linux. The altered application removed normal setup options, coerced users into entering wallet recovery phrases, validated the words against the BIP-39 mnemonic list, and exfiltrated completed seed phrases over HTTP, enabling theft of associated cryptocurrency. A parallel campaign used fake Ledger web pages, likely distributed by SMS, to steal recovery phrases without requiring a download.
Separate infrastructure analysis tied Ledger-themed domains to a broader homograph-domain operation that also impersonated Brave, Signal, and Telegram through internationalized domain names encoded with the xn-- Punycode prefix. Silent Push identified domains such as xn--brav-yva[.]com, promoted through Google ads, that delivered ISO files linked to the RedLine infostealer, and said the registrations and hosting overlapped with other brand-impersonation activity. Together, the reporting shows attackers combining breach-themed social engineering, IDN spoofing, and malware delivery to compromise cryptocurrency holders and steal credentials or wallet access without attacking Ledger hardware directly.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
The domain xn--brav-yva[.]com, impersonating Brave as bravė[.]com, was registered through NameCheap. Silent Push linked it to a broader cluster of punycode lookalike domains impersonating brands including Ledger, Signal, and Telegram.
By this point, the same actor had launched a second campaign that stole Ledger recovery phrases through a web flow rather than a malicious application. The landing pages, likely distributed by SMS, guided victims through fake wallet connection steps before collecting mnemonic words.
Proofpoint discovered several thousand phishing emails impersonating Ledger that claimed users’ assets were at risk and directed recipients to a spoofed Ledger Live download page. The campaign used a punycode lookalike domain and offered trojanized installers for Windows, macOS, and Linux.
Ledger disclosed a breach involving 9,500 customers’ names and contact information. The company warned users to watch for phishing attempts and said it would never ask for the 24 words of a recovery phrase.
A Brave security engineer reported an impersonating domain promoted through Google ads. Silent Push found the site delivered an ISO installer that appeared to contain the RedLine infostealer and tied it to related homoglyph infrastructure.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
blog.morphisec.com
Open sourcesilentpush.com
Open sourceproofpoint.com
Open sourceen.wikipedia.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers and incident responders documented a targeted intrusion campaign by **CryptoMimic**—also tracked as **Dangerous Password**, **CageyChameleon**, and **Leery Turtle**—that focused on banks, financial organizations, and especially cryptocurrency businesses. The attacks used spear-phishing lures that delivered ZIP or RAR archives containing malicious `.lnk` shortcut files and decoy documents; when opened, the shortcuts launched `mshta.exe` to fetch remote HTML or VBScript payloads. JPCERT/CC said the activity hit Japanese organizations tied to cryptocurrency operations, while later analysis captured a full intrusion chain in which the initial script deployed staged implants including **Cabbage RAT** variants, a browser information stealer, **msoRAT**, and a credential theft component that abused Windows Security Packages. Across the reports, the malware showed consistent tradecraft: persistence through Startup-folder shortcuts and registry changes, victim filtering and antivirus checks, host reconnaissance via WMI, and command-and-control through **Bitly** links and spoofed cloud-themed domains such as **cloudfiles.club** and **msupdatepms.xyz**. The operators collected browser cookies, saved passwords, OS and hardware details, process lists, and likely system credentials, then used interactive follow-on access, including legitimate **VNC** tools, for manual post-compromise activity and possible cryptocurrency theft. Investigators also observed cleanup actions such as event log deletion and destructive behavior, and noted that the tooling and operational patterns shared multiple similarities with activity previously linked to **Lazarus**, though attribution remained unconfirmed.
Aug 15, 2026
Researchers identified a **FakeWallet** campaign that placed at least **26 malicious iOS apps** in Apple’s App Store, where they impersonated well-known cryptocurrency wallets including **MetaMask, Ledger, Trust Wallet, Coinbase, TokenPocket, imToken, and Bitpie**. The apps primarily targeted users in **China**, taking advantage of the fact that many legitimate crypto wallet apps were unavailable in the local App Store, and used typosquatting, fake branding, and phishing flows to redirect victims to browser-based credential theft pages or trojanized wallet installers. Investigators said the operation had likely been active since at least late 2025, and Apple was notified and removed several of the identified apps. The malware used multiple techniques to steal wallet secrets from both hot-wallet and cold-wallet companion apps, including **malicious `dylib` injection**, executable hooking, provisioning profiles, and **React Native code tampering**. For hot wallets, the implants scraped mnemonic seed phrases and private keys directly from wallet interfaces; for Ledger-themed variants, the apps displayed convincing in-app prompts and fake verification pages to trick users into entering recovery phrases. Stolen data was **RSA PKCS #1-encrypted**, Base64-encoded, and sent to attacker-controlled servers, and researchers assessed the activity may be linked to the **SparkKitty** threat based on shared modules, Chinese-language artifacts, similar fake App Store-style distribution, and overlapping cryptocurrency theft objectives.
Jun 29, 2026
Multiple reports describe **active malware campaigns targeting Windows users** with a focus on **credential, session, and wallet theft** delivered through social engineering and abuse of legitimate services. **CharlieKirk Grabber**, a Python infostealer packaged with *PyInstaller*, is distributed via phishing, cracked software, cheats, and social-media lures; it kills browser processes (via `TASKKILL`) to access credential stores, collects passwords/cookies/autofill/Wi‑Fi data, zips the loot, uploads it to *GoFile*, and relays the download link to operators via **Discord webhooks** or **Telegram bots**. Separately, attackers are buying **Facebook ads** impersonating Microsoft to drive victims to cloned Windows 11 download pages on lookalike domains (e.g., `ms-25h2-update[.]pro`), delivering a malicious installer that steals saved passwords, browser sessions, and **cryptocurrency wallet** data; the campaign uses **geofencing/sandbox evasion** to show benign content to data-center IPs while serving malware to likely end users. Other contemporaneous activity highlights broader Windows-targeted intrusion tradecraft and adjacent threats. FortiGuard Labs reported **Winos 4.0 (ValleyRat)** phishing campaigns in Taiwan using tax and e-invoice lures, with delivery chains including malicious **LNK** downloaders, **DLL sideloading**, and **BYOVD** using the vulnerable driver `wsftprm.sys`, supported by rapidly rotating domains and cloud hosting. In LATAM, a fake bank-receipt lure delivers **XWorm v5.6** via a `.pdf.js` double-extension WSH dropper that uses junk-padding and Unicode obfuscation, then reconstructs and runs PowerShell (spawned via WMI) and abuses trusted hosting (e.g., Cloudinary) for later stages—enabling credential theft and potential ransomware follow-on. Additional reporting covered a USB-propagating **Monero cryptomining** operation capable of crossing air-gapped environments, a new Linux **SysUpdate** variant with encrypted C2 traffic (and a Unicorn Engine-based decryption approach developed during DFIR), and the **Foxveil** loader abusing **Cloudflare Pages, Netlify, and Discord** to stage shellcode and persist via services or *SysWOW64* masquerading—these are separate threats but reinforce the trend of attackers blending into trusted infrastructure and common user workflows.
Jun 29, 2026