Sophisticated Supply Chain Attack Targets Crypto Users with Counterfeit Ledger Wallets A Brazilian cybersecurity researcher uncovered a large-scale supply chain scam involving counterfeit Ledger Nano S Plus hardware wallets sold on a Chinese marketplace. The fake devices, designed to drain cryptocurrency across 20 blockchains, were engineered with tampered hardware, trojanized software, and cross-platform malware creating a seamless phishing pipeline. The researcher, u/Past_Computer2901, purchased the device at the same price as the official Ledger store, with packaging that appeared authentic. Suspicion arose only after the device failed Ledger’s Genuine Check when connected to a legitimate Ledger Live installation. A physical teardown revealed the original secure element chip had been replaced with an ESP32-S3 microcontroller, a generic IoT component from Espressif Systems, with its markings scraped off to avoid detection. The counterfeit device also included a WiFi/Bluetooth antenna, absent in genuine Ledger wallets. Firmware analysis exposed the full extent of the compromise: every PIN entry and seed phrase was stored in plaintext and transmitted to attacker-controlled command-and-control (C2) servers, including the domain kkkhhhnnn[.]com. The fake firmware, labeled "Nano S+ V2.1" a version that doesn’t exist in Ledger’s official releases was designed to impersonate a legitimate update. The scam extended beyond the hardware. The counterfeit device shipped with a QR code directing users to a cloned phishing site, where they downloaded a trojanized Ledger Live app. The fake app bypassed security warnings with a hardcoded "Genuine Check" that always returned a success screen, ensuring victims remained unaware of the breach. The malware also exfiltrated wallet data upon use and was distributed across Android, Windows, macOS, and iOS, with the iOS variant spread via Apple’s TestFlight to evade App Store reviews. Infrastructure analysis linked the operation to a Shanghai-based shell company, with three C2 servers, a cloned website, and a QR code redirect chain. While Ledger’s official Genuine Check can detect the counterfeit device, the scam’s success relied on victims never using the legitimate Ledger Live app. The researcher submitted a full technical report to Ledger’s security team, with further analysis pending. The attack has already resulted in confirmed financial losses exceeding $9.5 million across more than 50 victims, marking one of the most advanced hardware wallet supply chain attacks documented to date.

Seven Critical Vulnerabilities in FatFs Expose IoT and Embedded Devices to Attacks Cybersecurity firm runZero disclosed seven vulnerabilities in FatFs, a widely used open-source filesystem library for embedded and IoT devices, on July 6, 2026. The flaws, ranging from CVSS 4.6 (Medium) to 7.6 (High), can lead to memory corruption, crashes, data leaks, or remote code execution when devices process maliciously crafted storage media (e.g., USB drives, SD cards). ### Discovery and Impact The vulnerabilities were uncovered during a 2026 re-audit of FatFs, which had previously undergone a 2017 security review with minimal findings. This time, researchers leveraged GitHub Copilot in auto mode to automate fuzzing and exploit validation, revealing issues that manual testing had missed. The flaws affect numerous platforms, including: - Espressif ESP-IDF - STMicroelectronics STM32Cube - Zephyr RTOS - MicroPython - ArduPilot - RT-Thread - Mbed - Samsung TizenRT - SWUpdate Downstream devices such as security cameras, voting machines, ATMs, drones, and industrial controllers are at risk, particularly those lacking modern memory protections like ASLR. Physical access to vulnerable devices could allow attackers to gain full control, while two flaws (CVE-2026-6682, CVE-2026-6683) also enable remote exploitation via firmware updates. ### Vulnerability Breakdown 1. CVE-2026-6682 (CVSS 7.6) – FAT32 integer overflow in `mount_volume()` leading to heap/stack corruption and potential code execution. 2. CVE-2026-6687 (CVSS 7.6) – exFAT label-length stack overflow causing memory corruption. 3. CVE-2026-6688 (CVSS 7.6) – Long filename overflow in downstream code, risking buffer overflows via `strcpy`/`sprintf`. 4. CVE-2026-6685 (CVSS 6.1) – Unsigned subtraction wrap in dirty-cache handling, risking silent data corruption. 5. CVE-2026-6683 (CVSS 4.6) – exFAT divide-by-zero in sync/write paths, causing crashes or bricking during firmware updates. 6. CVE-2026-6686 (CVSS 4.6) – Uninitialized cluster exposure, leaking stale deleted file data. 7. CVE-2026-6684 (CVSS 4.6) – GPT partition scan loop in pre-R0.16 versions, enabling boot-time denial-of-service. ### Patch Status and Challenges FatFs is maintained by a single developer, who did not respond to disclosure attempts. JPCERT/CC was also unable to facilitate coordination. Only one flaw (CVE-2026-6684) has an upstream fix (in R0.16), but vendors must manually integrate it into their vendored copies. The lack of a responsive maintainer and widespread custom modifications by vendors complicate patching, mirroring delays seen in past disclosures like PixieFail (2024). ### Proof-of-Concept and Current Threat runZero released proof-of-concept disk images, a test harness, and a QEMU-based exploit demo in a public repository. As of the disclosure date, no active attacks had been reported. However, the automated tooling used to find these flaws is now widely accessible, increasing the risk of future exploitation. The vulnerabilities underscore the long-term risks of widely embedded, minimally maintained components in critical infrastructure and consumer devices.