Ledger “We Are Now Quantum-Resistant” Email: Phishing Warning

An email titled “We are now quantum-resistant”, apparently sent by “Ledger Live,” claims that Ledger has upgraded its firmware to protect devices against future quantum-computing threats. It invites recipients to click a “Get Started” button.

Warning: The email we received on November 3, 2026, is a phishing attempt. Our investigation confirmed that its link redirects to a fake Ledger Live website flagged as malicious by Google Safe Browsing.

What Does the Email Say?

The message discusses AI, quantum computing, and the potential threat to the cryptography protecting digital assets. It then states:

“That is why we have updated our firmware to be quantum-resistant, adding a stronger layer of protection designed to keep your device secure today and well into the future.”

The email ends with a prominent “Get Started” button.

Where Does the Link Lead?

We examined the email's “Get Started” link using an external website analysis service.

The analysis confirmed that the link passes through a tracking URL under an unrelated domain before redirecting visitors to a separate website impersonating Ledger Live.

The destination page is titled “Ledger Live” and displays cryptocurrency-themed graphics, including Bitcoin and Ethereum symbols. It features the message “Buy and sell crypto securely” and two buttons: “Start with Ledger Live” and “Buy a new Ledger device.”

Screenshot: The fraudulent website impersonating Ledger Live, captured during our investigation.

Google Safe Browsing identified the destination as malicious. The website analysis service also classified it as potentially malicious.

Another notable detail is that the final redirected URL contained a recipient email address as a parameter. This indicates that the link carried recipient-specific information, potentially allowing the operators to associate visits with individual email addresses.

We did not interact with the fake website's buttons or verify its subsequent behavior. Therefore, the exact method used to steal wallet information or cryptocurrency remains unconfirmed.

Why Is This Email a Phishing Attempt?

  • Misleading sender identity: The display name is “Ledger Live,” but the actual sender address is noreply@invictastores.com, which is not an official Ledger email domain.
  • Fake Ledger Live website: The email redirects to a separate domain impersonating Ledger Live rather than an official Ledger website.
  • Malicious destination: Google Safe Browsing flagged the final destination as malicious.
  • Firmware-related pretext: Ledger warns that it does not send emails asking customers to update their device firmware or operating system.

Is Ledger Really Developing Quantum-Resistant Security?

Yes. Ledger announced post-quantum cryptography support in its SDK in July 2026, including implementations of ML-KEM and ML-DSA.

However, this genuine technical development does not mean that the email is authentic or that every Ledger device has already become fully quantum-resistant.

The phishing email appears to exploit a real security development to make its fraudulent update claim more convincing.

What Should You Do?

  • Do not click the email's “Get Started” button.
  • Do not download software through links in unsolicited messages.
  • Never enter your 24-word Secret Recovery Phrase on a website or share it with anyone.
  • For legitimate firmware updates, open Ledger's official application independently and follow its instructions.
  • If you have already disclosed your recovery phrase, treat it as compromised. Use a trusted device and a new, securely generated recovery phrase to move any remaining assets to a new wallet as soon as possible.

Even if an email refers to genuine security developments, always verify update instructions through the service's official website or application rather than following links in the message.

For further information, see Ledger's official phishing warnings and its post-quantum cryptography announcement.

Comments

Post a Comment

Popular posts from this blog

“The NASA-backed Vicks trick reversing severe memory decline fast” VapoCept Email: Elon Musk Claims Are Unsupported

Image
Warning: I received a spam email claiming that Elon Musk had revealed a “NASA-backed” Vicks trick capable of reversing memory loss and dementia. The email promotes a supplement called VapoCept and presents the supposed treatment as a major scientific breakthrough. I could not find credible evidence supporting the NASA or Elon Musk claims, and the medical claims conflict with established information from the FDA and the official Vicks product information. Do not click any links in this email, and do not rely on its claims about memory loss or dementia. The email I received Subject: The NASA-backed Vicks trick reversing severe memory decline fast Sender: NASA Protocol Desk (support＠uploadboy.com) Received: September 20, 2026 The message claimed: Elon Musk had revealed a “15-second” protocol for memory loss and dementia. The method was inspired by NASA. It could outperform prescription drugs used for Alzheimer’s disease. The technique involved Vicks together with...
Read more

ArterioFlush Scam Email: Dr. Oz “Arterial Flush Ritual” and CBS News Claims

Image
Warning: I received an unsolicited email promoting a product called ArterioFlush and claiming that a simple “Arterial Flush Ritual” can rapidly reverse high blood pressure. The email had the subject line “Watch before deleted: The simple ritual resetting BP to 118/78” and showed the sender as support@eurobunker-arena.com . It uses CBS News branding and Dr. Oz’s name while claiming that a substance called “Arterial Cement” is responsible for hypertension and can supposedly be flushed away with a natural compound. Why this email is suspicious The displayed sender address is unrelated to CBS News. The link presented as a CBS News presentation does not lead to cbsnews.com. It points to a Google Cloud Storage address instead. The email makes dramatic medical claims, including large blood-pressure reductions within days and the removal of arterial plaque. It specifically names prescription drugs such as Losartan, Amlodipine, and Lisinopril while presenting the promoted “ritua...
Read more

MetaMask phishing email from system@phrase.com: “Please set up your new sign option and link your email”

Image
I received a suspicious email impersonating MetaMask with the subject: Please set up your new sign option and link your email The visible sender was: TheMetamaskTeamTMS Phrase <system@phrase.com> This email is particularly worth documenting because Gmail reported that its authentication checks passed: SPF: PASS DKIM: PASS for phrase.com DMARC: PASS However, passing SPF, DKIM and DMARC does not mean that MetaMask sent or authorized the message. What the email says The message asks the recipient to set up a “new sign option” and link an email address. It says the action applies to all users and creates urgency by stating that the link will expire after 24 hours. The main button says: Set Up New Sign Option & Link Email The email also states: This link will expire after 24 hours. I have intentionally not reproduced the destination URL in this article. Why this email should not be trusted as a MetaMask message MetaMask's own Help Center ...
Read more