The letter claims to be from Ledger’s security team and asks users to give their recovery phrase in response to a “critical security update.”