885,000 phone numbers were run through one scheme to find the crypto owners among them
Rapid7 found an exposed directory on the operators’ server and mapped the whole chain. They call it Operation ASTERIX.
Out of a German list of 316,002 numbers, a custom checker confirmed 43,066 live Crypto.com accounts.
Then the victim got an email from the "exchange" with a case number and a code. Minutes later a "support agent" called and read out the same case number and the same code. That match across two channels does all the work.
The finish line is a link to an "updated wallet app". Rapid7 recovered fake Trezor Suite, Ledger Live and Exodus builds for macOS and Windows. The fake waits for the real app to open, kills it, and shows its own recovery screen.
A real wallet app never asks for your recovery phrase on a normal login. If it asks, it is not the real one. Rapid7 write-up.
#security
📈 ByBit: up to $30,000 bonus — my pick for trading!
🔗 My channels: Youtube • X • LinkedIn • Instagram • Threads
Rapid7 found an exposed directory on the operators’ server and mapped the whole chain. They call it Operation ASTERIX.
Out of a German list of 316,002 numbers, a custom checker confirmed 43,066 live Crypto.com accounts.
Then the victim got an email from the "exchange" with a case number and a code. Minutes later a "support agent" called and read out the same case number and the same code. That match across two channels does all the work.
The finish line is a link to an "updated wallet app". Rapid7 recovered fake Trezor Suite, Ledger Live and Exodus builds for macOS and Windows. The fake waits for the real app to open, kills it, and shows its own recovery screen.
A real wallet app never asks for your recovery phrase on a normal login. If it asks, it is not the real one. Rapid7 write-up.
#security
📈 ByBit: up to $30,000 bonus — my pick for trading!
🔗 My channels: Youtube • X • LinkedIn • Instagram • Threads