A Twitter user going by WizardofAus has warned the cryptocurrency community a malicious browser extension is trying to steal from Ledger wallet users, and already took $16,000 from one.
According to the Twitter user, the extension “Ledger Secure” contains malware that passes users’ seed phrases to the extension’s creator, effectively giving them access to the funds stored on the Ledger wallet.
☠️ Malware Chrome extension alert ☠️
If you have “Ledger Secure” installed – REMOVE IT.
The @ChromeExtension “Ledger Secure” contains malware that passes your seed phrase back to the extension's author.
This is *not* a @Ledger product.
Successfully used against @hackedzec 👇— WizardofAus 🇦🇺⚡🌮 [Jan3🔑] (@BTCSchellingPt) January 2, 2020
In one case the user mentioned, someone with the handle “hackedzec,” alluding to what happened, claimed the extension managed to steal a total of 600 ZEC from his wallet, worth around $16,000.
Ledger Support’s official Twitter account confirmed the malicious extension was indeed trying to phish users, and warned the cryptocurrency community. It further asked those who installed it to contact them.
⚠️PHISHING ALERT⚠️
A Chrome extension malware has been detected called “Ledger Secure”. This is NOT a legitimate Ledger application
DO NOT use it and contact us if you've installed it:https://t.co/bRaDjYHZbY
You can help by reporting the extension:https://t.co/oltHbtA8RR
— Ledger Support (@Ledger_Support) January 2, 2020
WizardofAus advised other cryptocurrency holders to be “very careful” regarding the extensions they install on their browsers, adding that it’s better to “have a separate minimal machine – or use a Virtual Machine that is the only place you do crypto activity.”
Moreover, users should always confirm they’re using the wallet vendor’s proprietary software and double check what they’re using does indeed come from the vendor. Phishing scams are unfortunately nothing new in the cryptocurrency space, as these attacks even took $28,600 from users of the peer-to-peer exhcnage LocalBitcoins last year.
As CryptoGlobe reported, scammers have even created fake cryptocurrency trading websites to trick users into obtaining the login credentials of others on legitimate cryptocurrency exchanges. In one case, South Korean Authorities and the U.S. Federal Bureau of Investigation (FBI) uncovered a massive $800,000 phishing scam targeting XRP investors.
Featured Image Credit: Photo via Pixabay
