(zscaler.com) Threat Actors Exploit Google Ads to Target Ledger Hardware Wallet Users in Sophisticated Phishing Campaign In brief - This article describes a phishing campaign that utilized fraudulent Google ads to target Ledger hardware wallet users and steal their secret recovery phrases. Technically - This article details a multi-stage redirect chain starting from sponsored Google ads that routed victims through Google Cloud Storage and Vercel to a Google Sites page hosting a phishing interface within an iframe. To evade detection, the attackers rotated Vercel-hosted redirect domains every 15-20 minutes and implemented a phishing page that collected device metadata and user interactions to filter out automated analysis tools. The site utilized a BIP-39 English wordlist via an API to provide autocomplete suggestions for recovery phrases, which were then exfiltrated to an attacker-controlled Vercel endpoint after a fake two-step verification process involving an invisible hCaptcha widget. Source: https://www.zscaler.com/blogs/security-research/threat-actors-use-google-ads-target-ledger-users #Cybersecurity