Crypto▼ Bearish
Phishing Ring Exposed: 885K Phone Numbers, Fake Trezor Apps
A misconfigured server exposed a fraud operation with 885K phone numbers, fake Trezor and Ledger apps, and a 13.6% hit rate on Crypto.com accounts. Rapid7 details the attack chain and implications for exchanges.
Continue with
A misconfigured web server exposed a fraud operation that combined phishing emails, voice calls, and counterfeit wallet applications to steal crypto recovery phrases. Rapid7 Labs documented the scheme and called it Operation ASTERIX.
The exposed directory contained roughly 885,000 phone numbers. The largest batch was 316,002 German mobile numbers. The fraudsters used Asterisk, an open-source telephony platform, to make vishing calls, the researchers said.
On the account validation side, the operation targeted Crypto.com users specifically. The attackers ran automated checks against their database of phone numbers. The hit rate was 13.6%, meaning roughly one in seven numbers corresponded to an active account, Rapid7 found.
Once potential victims were identified, the attack chain moved to personalized email outreach and phone calls. These steered targets toward installing fake wallet applications. The counterfeit apps masqueraded as Trezor Suite and Ledger Live. The bogus software prompted users to enter their 12-to-24-word recovery phrases, which were then exfiltrated via Telegram.