Date: 09/28/2026
Severity: Medium
Summary
Threat actors used fraudulent Google Ads to target Ledger hardware wallet users with a phishing campaign. The ads redirected victims through Google Cloud Storage and frequently changing Vercel domains to a fake Ledger page hosted through Google Sites. A fraudulent device-verification process tricked users into entering their secret recovery phrases, which were then sent to attacker-controlled infrastructure, potentially allowing unauthorized access to their crypto wallets.
Indicators of Compromise (IOC) List
Domains/URLs | storage.googleapis.com/apf-leg-ad-23798/ storage.googleapis.com/ledg-leg1-79230/ storage.googleapis.com/apf-leg-ad-22076/ storage.googleapis.com/apf-leg-ad-32595/ sites.google.com/view/start-ledger-wallet sites.google.com/view/apps-ledger-wallet sites.google.com/view/download-ledger-wallet-pc soyyoo-cwpc5n0e.vercel.app rpc-gbz5.vercel.app whyavc-qwmv6stx.vercel.app router-wdoi.vercel.app node-f1ey.vercel.app |
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | domainname like "node-f1ey.vercel.app" or url like "node-f1ey.vercel.app" or siteurl like "node-f1ey.vercel.app" or domainname like "router-wdoi.vercel.app" or url like "router-wdoi.vercel.app" or siteurl like "router-wdoi.vercel.app" or domainname like "whyavc-qwmv6stx.vercel.app" or url like "whyavc-qwmv6stx.vercel.app" or siteurl like "whyavc-qwmv6stx.vercel.app" or domainname like "rpc-gbz5.vercel.app" or url like "rpc-gbz5.vercel.app" or siteurl like "rpc-gbz5.vercel.app" or domainname like "soyyoo-cwpc5n0e.vercel.app" or url like "soyyoo-cwpc5n0e.vercel.app" or siteurl like "soyyoo-cwpc5n0e.vercel.app" or domainname like "storage.googleapis.com/apf-leg-ad-23798/" or siteurl like "storage.googleapis.com/apf-leg-ad-23798/" or url like "storage.googleapis.com/apf-leg-ad-23798/" or domainname like "storage.googleapis.com/ledg-leg1-79230/" or siteurl like "storage.googleapis.com/ledg-leg1-79230/" or url like "storage.googleapis.com/ledg-leg1-79230/" or domainname like "storage.googleapis.com/apf-leg-ad-22076/" or siteurl like "storage.googleapis.com/apf-leg-ad-22076/" or url like "storage.googleapis.com/apf-leg-ad-22076/" or domainname like "storage.googleapis.com/apf-leg-ad-32595/" or siteurl like "storage.googleapis.com/apf-leg-ad-32595/" or url like "storage.googleapis.com/apf-leg-ad-32595/" or domainname like "sites.google.com/view/start-ledger-wallet" or siteurl like "sites.google.com/view/start-ledger-wallet" or url like "sites.google.com/view/start-ledger-wallet" or domainname like "sites.google.com/view/apps-ledger-wallet" or siteurl like "sites.google.com/view/apps-ledger-wallet" or url like "sites.google.com/view/apps-ledger-wallet" or domainname like "sites.google.com/view/download-ledger-wallet-pc" or siteurl like "sites.google.com/view/download-ledger-wallet-pc" or url like "sites.google.com/view/download-ledger-wallet-pc" |
Reference:
https://www.zscaler.com/blogs/security-research/threat-actors-use-google-ads-target-ledger-users#indicators-of-compromise--iocs-