BEWARE: A Fake ‘Ledger Live’ Chrome Extension Wants to Steal Your Crypto Passphrase

The Google Chrome browser has turned out to be a one-stop tool for imposters to deliver, promote, and execute fake extensions mostly on cryptocurrency wallets, perhaps, in order to access and steal the funds of unsuspecting people. 

A malicious extension on the just-updated Ledger Live, an app that allows users to manage their crypto assets, was recently spotted on Chrome. The ID of the fake Ledger extension was “idnelecdpebmbpnmambnpcjogingdfco,” and was heavily promoted on Google Search Ads, under search phrase, “Ledger Live.”

The extension had no browser permissions, and it unarguably was launched to phish for wallet secrets (to steal your seed phrases), from Ledger users. At the time of discovery, the fake extension already had 121 people using it. 

With the stolen wallet 24-word seed phrase, the attackers might be able to access contents on that Ledger wallet from another device — gain access to the victim’s cryptocurrency private keys, which potentially might result in losses.

The extension is certainly not from Ledger, although it is bearing Ledger Live. The cryptocurrency wallet has issued warnings to users on several occasions to avoid sharing their 24 words, entering them into any internet-connected device, as it will never ask users for their 24 words. 

Cryptocurrency wallets users, especially Ledger, are the prime target of malicious attackers in the industry. There have been different attacks launched against Ledger on one purpose, to scam users. This could be related to the fact that Ledger has a good number of users. 

In June 2019, a red flag was raised over a fake Ledger support number, which was circulating all over the internet and scamming unaware victims who appear to be newbies, as Coinfomania reported.

The attackers created a website that provides a mobile number for customers to call Ledger support. They imposters manage to manipulate the site to the first page of google search results for “Ledger Nano S support number,” which gives them a better chance to dupe victims.

How Ledger is Fighting Against Imposters

Aside from issuing warnings to users, Ledger has been actively working to keep off these attackers. There have been several updates on Ledger Live with new technicalities to provide a secure environment for users to store their cryptos. 

In December, Ledger Vault, partnered with Coinstreet Partners and Global Intelligent Trust (GIT) to introduce a new digital asset custody service.

Meanwhile, the vulnerability of Google Chrome and other native browsers to allow fraudulent activities has paved the way for other new platforms such as the crypt0-focused Brave Browser to acquire over 8 million monthly active users within a few years.