The paper mailers mimic Ledger and Trezor branding and device update themes to push users toward malicious verification sites.