Blockchain security company SlowMist has issued a threat intelligence alert regarding a new phishing campaign targeting Ledger users. Scammers are exploiting the fallout from the October 9 CryptoBilis incident by sending fake "Ledger firmware update" emails, claiming the update is essential to protect against rising spyware threats. These emails lead to a fake "Genuine check" page that prompts users to enter their 24-word recovery phrase. Ledger reiterates that firmware updates are handled only through the official Ledger Live app, and users should never click website links or enter their recovery phrase anywhere.