{"id":12164,"date":"2026-08-21T06:40:13","date_gmt":"2026-08-21T06:40:13","guid":{"rendered":"https:\/\/cryptonews.uk.com\/?p=12164"},"modified":"2026-08-21T06:40:13","modified_gmt":"2026-08-21T06:40:13","slug":"operation-asterix-targets-885000-phone-numbers-in-crypto-phishing-campaign","status":"publish","type":"post","link":"https:\/\/cryptonews.uk.com\/?p=12164","title":{"rendered":"Operation Asterix Targets 885,000 Phone Numbers in Crypto Phishing Campaign"},"content":{"rendered":"<p><\/p>\n<div>\n<div id=\"blockquote-block_998fc2506f76febc606a165db686921b\" class=\"blockquote-container\" style=\"border-color: #5100fc\">\n<div class=\"blockquote-text\">\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Rapid7 Labs recovered roughly 885,000 phone numbers from an exposed server, the largest single file holding 316,002 German mobile numbers.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Account-checking tools confirmed 43,066 of those German numbers as Crypto.com account holders, a hit rate Rapid7 puts at about 13.6%.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Counterfeit Trezor Suite, Ledger Live and Exodus builds were made to drain wallets, with the Trezor clone sending stolen recovery phrases to a Telegram bot.<\/span><\/li>\n<\/ul>\n<\/div>\n<\/div>\n<p class=\"wp-block-paragraph\">Rapid7 researchers Anna \u0160irokova and Jan Recinsky have discovered Operation Asterix, finding a misconfigured web directory exposing a fraud operation\u2019s entire working environment, including phone-number datasets, account-validation tools, phishing panels, dialler scripts, counterfeit wallet builds and AI session logs.\u00a0<\/p>\n<p class=\"wp-block-paragraph\">The server held about 885,000 phone numbers split into files by region and source. The largest covered 316,002 German mobiles, with further lists for Hong Kong, Bulgaria, the UK, US and Canadian fintech services, and Ledger customers across 54 country files.\u00a0<\/p>\n<p class=\"wp-block-paragraph\">A Go-based checker pushed those numbers through a Crypto.com account-existence endpoint using 300 concurrent threads and rotating residential proxies, confirming 43,066 accounts from the German set, and a separate checker targeted Kraken.<\/p>\n<p class=\"wp-block-paragraph\">Matches were enriched with names, email addresses, locations, account details and sometimes payment-card context. One screenshot in the report shows the operator\u2019s Binance lead panel holding 5,576 validated targets queued for attack.\u00a0<\/p>\n<p class=\"wp-block-paragraph\">Rapid7 describes a targeted operation: one panel logged 20 lead lookups and six phishing emails over roughly two weeks.<\/p>\n<p class=\"wp-block-paragraph\"><strong>Read more: South Korea Orders Polymarket Blocked Over Illegal Gambling Concerns<\/strong><\/p>\n<p class=\"wp-block-paragraph\">The operators also cloned Anthropic\u2019s Claude Code documentation page at macos-claude[.]com, swapping the macOS install command for one that fetched a hidden Ledger Live clone, then ran the genuine Claude installer so nothing looked wrong.\u00a0<\/p>\n<p class=\"wp-block-paragraph\">Rapid7 found the operator used GitHub Copilot and Claude Code during development. When Claude declined to obfuscate the Ledger builds, the operator moved to Kimi and submitted a jailbreak prompt.\u00a0<\/p>\n<p class=\"wp-block-paragraph\">\u201cThe recovered evidence does not confirm whether Kimi complied,\u201d the report states. Rapid7 concludes that for this operator, model restrictions \u201cbecame another engineering problem to solve\u201d, and expects jailbreak attempts to become routine in malware pipelines.\u00a0<\/p>\n<p class=\"wp-block-paragraph\">It disclosed the infrastructure to authorities including Apple\u2019s security team, and published the indicators of compromise on GitHub.<\/p>\n<h2 id=\"h-how-the-wallet-apps-worked\" class=\"wp-block-heading\">How the Wallet Apps Worked<\/h2>\n<p class=\"wp-block-paragraph\">The counterfeit Trezor Suite ran as a hidden one-pixel transparent window, scanned the process list every five seconds, killed the genuine app when the victim opened it and pushed its own window forward.\u00a0<\/p>\n<p class=\"wp-block-paragraph\">Stolen phrases went to a Telegram bot with the victim\u2019s IP address before the victim was redirected to the real Trezor site. Its form accepted 12-, 18-, 20- or 24-word phrases, then returned a fake validation error so the victim typed the phrase again.\u00a0<\/p>\n<p class=\"wp-block-paragraph\">The Windows build was broken and worked only as a static seed-phrase collector. The fake Ledger Live swapped copied wallet addresses on Windows and hid from the macOS Dock.\u00a0<\/p>\n<p class=\"wp-block-paragraph\"><strong>Read also: Bitpanda Hit With \u20ac70,000 MiCA Fine in Austria\u2019s First Published Enforcement Action\u00a0<\/strong><\/p>\n<\/p><\/div>\n<p>Cryptocurrency,Hackers#Operation #Asterix #Targets #Phone #Numbers #Crypto #Phishing #Campaign1787294413<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Rapid7 Labs recovered roughly 885,000 phone numbers from an exposed server, the largest single file holding 316,002 German mobile numbers. Account-checking tools confirmed 43,066 of those German numbers as Crypto.com account holders, a hit rate Rapid7 puts at about 13.6%. Counterfeit Trezor Suite, Ledger Live and Exodus builds were made to drain wallets, with the<\/p>\n","protected":false},"author":1,"featured_media":12165,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[7],"tags":[6406,6407,62,2321,3822,595,154,564],"class_list":["post-12164","post","type-post","status-publish","format-standard","has-post-thumbnail","category-bitcoin","tag-asterix","tag-campaign","tag-crypto","tag-numbers","tag-operation","tag-phishing","tag-phone","tag-targets"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v26.6 (Yoast SEO v26.6) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Operation Asterix Targets 885,000 Phone Numbers in Crypto Phishing Campaign - Crypto News: Latest Cryptocurrency News and Analysis<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/cryptonews.uk.com\/?p=12164\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Operation Asterix Targets 885,000 Phone Numbers in Crypto Phishing Campaign\" \/>\n<meta property=\"og:description\" content=\"Rapid7 Labs recovered roughly 885,000 phone numbers from an exposed server, the largest single file holding 316,002 German mobile numbers. Account-checking tools confirmed 43,066 of those German numbers as Crypto.com account holders, a hit rate Rapid7 puts at about 13.6%. Counterfeit Trezor Suite, Ledger Live and Exodus builds were made to drain wallets, with the\" \/>\n<meta property=\"og:url\" content=\"https:\/\/cryptonews.uk.com\/?p=12164\" \/>\n<meta property=\"og:site_name\" content=\"Crypto News: Latest Cryptocurrency News and Analysis\" \/>\n<meta property=\"article:published_time\" content=\"2026-08-21T06:40:13+00:00\" \/>\n<meta name=\"author\" content=\"\u884c\u653f\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"\u884c\u653f\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=12164\",\"url\":\"https:\/\/cryptonews.uk.com\/?p=12164\",\"name\":\"Operation Asterix Targets 885,000 Phone Numbers in Crypto Phishing Campaign - Crypto News: Latest Cryptocurrency News and Analysis\",\"isPartOf\":{\"@id\":\"https:\/\/cryptonews.uk.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=12164#primaryimage\"},\"image\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=12164#primaryimage\"},\"thumbnailUrl\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/08\/crypto-phishing.jpg\",\"datePublished\":\"2026-08-21T06:40:13+00:00\",\"author\":{\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf\"},\"breadcrumb\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=12164#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/cryptonews.uk.com\/?p=12164\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=12164#primaryimage\",\"url\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/08\/crypto-phishing.jpg\",\"contentUrl\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/08\/crypto-phishing.jpg\",\"width\":1920,\"height\":1047},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=12164#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/cryptonews.uk.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Operation Asterix Targets 885,000 Phone Numbers in Crypto Phishing Campaign\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/cryptonews.uk.com\/#website\",\"url\":\"https:\/\/cryptonews.uk.com\/\",\"name\":\"Crypto News: Latest Cryptocurrency News and Analysis\",\"description\":\"Latest Crypto &amp; Bitcoin News\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/cryptonews.uk.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf\",\"name\":\"\u884c\u653f\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g\",\"caption\":\"\u884c\u653f\"},\"sameAs\":[\"http:\/\/demo3.aiwalls.com\/coinbase\"],\"url\":\"https:\/\/cryptonews.uk.com\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Operation Asterix Targets 885,000 Phone Numbers in Crypto Phishing Campaign - Crypto News: Latest Cryptocurrency News and Analysis","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/cryptonews.uk.com\/?p=12164","og_locale":"en_US","og_type":"article","og_title":"Operation Asterix Targets 885,000 Phone Numbers in Crypto Phishing Campaign","og_description":"Rapid7 Labs recovered roughly 885,000 phone numbers from an exposed server, the largest single file holding 316,002 German mobile numbers. Account-checking tools confirmed 43,066 of those German numbers as Crypto.com account holders, a hit rate Rapid7 puts at about 13.6%. Counterfeit Trezor Suite, Ledger Live and Exodus builds were made to drain wallets, with the","og_url":"https:\/\/cryptonews.uk.com\/?p=12164","og_site_name":"Crypto News: Latest Cryptocurrency News and Analysis","article_published_time":"2026-08-21T06:40:13+00:00","author":"\u884c\u653f","twitter_card":"summary_large_image","twitter_misc":{"Written by":"\u884c\u653f","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/cryptonews.uk.com\/?p=12164","url":"https:\/\/cryptonews.uk.com\/?p=12164","name":"Operation Asterix Targets 885,000 Phone Numbers in Crypto Phishing Campaign - Crypto News: Latest Cryptocurrency News and Analysis","isPartOf":{"@id":"https:\/\/cryptonews.uk.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/cryptonews.uk.com\/?p=12164#primaryimage"},"image":{"@id":"https:\/\/cryptonews.uk.com\/?p=12164#primaryimage"},"thumbnailUrl":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/08\/crypto-phishing.jpg","datePublished":"2026-08-21T06:40:13+00:00","author":{"@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf"},"breadcrumb":{"@id":"https:\/\/cryptonews.uk.com\/?p=12164#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/cryptonews.uk.com\/?p=12164"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptonews.uk.com\/?p=12164#primaryimage","url":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/08\/crypto-phishing.jpg","contentUrl":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/08\/crypto-phishing.jpg","width":1920,"height":1047},{"@type":"BreadcrumbList","@id":"https:\/\/cryptonews.uk.com\/?p=12164#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/cryptonews.uk.com\/"},{"@type":"ListItem","position":2,"name":"Operation Asterix Targets 885,000 Phone Numbers in Crypto Phishing Campaign"}]},{"@type":"WebSite","@id":"https:\/\/cryptonews.uk.com\/#website","url":"https:\/\/cryptonews.uk.com\/","name":"Crypto News: Latest Cryptocurrency News and Analysis","description":"Latest Crypto &amp; Bitcoin News","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/cryptonews.uk.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf","name":"\u884c\u653f","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g","caption":"\u884c\u653f"},"sameAs":["http:\/\/demo3.aiwalls.com\/coinbase"],"url":"https:\/\/cryptonews.uk.com\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts\/12164","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=12164"}],"version-history":[{"count":0,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts\/12164\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/media\/12165"}],"wp:attachment":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=12164"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=12164"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=12164"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}