Operation Asterix used fake wallet sites and apps to steal seed phrases
Rapid7 described a phishing campaign dubbed Operation Asterix, targeting approximately 885,000 phone numbers in several countries. According to the cybersecurity firm, the campaign aimed to steal cryptocurrencies by redirecting victims to fake websites impersonating wallet providers.
The largest file analyzed by Rapid7 contained 316,002 German mobile numbers. The recovered lists also included contacts from Hong Kong, Bulgaria, the United Kingdom, the United States, Canadian fintech companies, and lists linked to Ledger. From the German data, Rapid7 identified 43,066 accounts associated with cryptocurrency exchange users; the records also showed 5,576 Binance accounts queued for the attack and fake emails mimicking Crypto.com.
According to Rapid7, the attackers contacted users through fake support emails and phone calls, directing them to counterfeit Ledger, Trezor, and Exodus apps to steal their seed phrases.
The report also flags a checker for Kraken, designed to bulk-verify the association between phone numbers and exchange accounts. The recovered artifacts indicate that artificial intelligence tools were a significant part of the campaign.
