Operation Asterix Crypto Phishing: Are You a Target?

Security firm Rapid7 says it stumbled onto a live Operation Asterix crypto phishing pipeline after finding a misconfigured server that exposed the whole operation: raw lists of 885,000 phone numbers, a Go-based tool that checked each one against Crypto.com's passkey-verification system, and the fake wallet apps used to drain confirmed victims. This is not a rumor or a leaked-database scare story — Rapid7 watched the machinery working and traced it end to end, from phone number to stolen seed phrase.

Why it matters now: the operator combined old-fashioned data scraping with AI coding tools to move faster, and got flagged for the AI angle specifically after Claude refused to help obfuscate the malware. That refusal, and the workaround the operator used to get around it, is arguably the more interesting part of the story for anyone tracking how AI guardrails hold up against real criminal use.

The 885,000 figure is a raw phone-number list, not a confirmed victim count, and most people on it were never actually reached. The largest single batch was 316,002 German numbers, alongside smaller lists tied to Hong Kong, Bulgaria, the UK, US and Canada, plus a separate list covering 54 countries built from known Ledger hardware-wallet owners.

The number that should actually worry you is smaller and scarier in a different way: running the German list through Crypto.com's verification endpoint returned a 13.6% hit rate — 43,066 numbers confirmed as live, real accounts. Once a number was confirmed live, that person became a real target for the next stage, not just an entry in a spreadsheet. If you hold crypto and use a phone number tied to any exchange or wallet account, especially in the countries above, treat any unexpected support contact as suspicious by default, not just this week.

Confirmed targets got a coordinated, multi-channel push designed to feel official. First came an email from fake "support," complete with a case number. Then a phone call — vishing, voice phishing — referencing that same case number along with the target's real name and account details. That repetition is the trick: two different channels citing the same reference number feels like proof you're dealing with a real support ticket, when it's really the same script reused twice.

The call steers the victim toward installing a fake version of Trezor Suite, Ledger Live or Exodus — desktop wallet-management apps people already trust. The fake app kills the real one's running process so there's no conflict, then presents a near-identical interface. From there it harvests the victim's 12-to-24-word recovery phrase, the master key to every asset in that wallet. In a nasty detail Rapid7 flagged, the app will even auto-split a pasted phrase across input fields and then ask the victim to re-enter it "to validate" — a second capture disguised as a security step. The phrase, plus any passphrase and the victim's IP address, gets sent straight to three separate Telegram bots controlled by the operator.

Partly, and the details are more reassuring than the headlines suggest. The operator used Claude Code and GitHub Copilot to speed up building the supporting infrastructure — the target-management system and the phone-verification checker. That's real, and it's a legitimate story about AI lowering the skill bar for cybercrime tooling.

But when the operator asked Claude directly to help obfuscate the malware itself, Claude declined. That forced a switch to a more permissive model, Kimi K2.7, reached through a crude jailbreak prompt that reportedly still had Claude-specific tags left in it — a sign of an operator copy-pasting a workaround rather than someone technically sophisticated. The realistic read: AI tools accelerated the boring scaffolding work around this operation, but they didn't hand a novice the ability to write evasive malware from scratch. The guardrail on the specific ask that mattered held.

A few checks apply whether or not you're on this particular list. Only install wallet software from the vendor's own website or the app store link on that website — never from a link texted, emailed or read out to you during a support call. If an app you already have open suddenly closes on its own right before a "new version" opens, treat that as a red flag, not a coincidence.

No legitimate wallet company or exchange will ever ask you to type or paste your recovery phrase into a support chat, a call, or an app prompt framed as "verification." Real support cannot see your seed phrase and does not need it — the phrase exists specifically so a company never has to ask for it. A case number repeated across an email and a phone call is not proof of legitimacy; scammers can put a number in a template as easily as a real company can.

If your phone number sits with Crypto.com, Ledger, or any exchange in Germany, Hong Kong, Bulgaria, the UK, US or Canada, be more alert than usual to unsolicited "your account needs verification" contact over the coming weeks. Rapid7 says it referred its findings to relevant authorities, including Apple's security team, so some takedown activity is plausible — but the firm also published the full attack-chain design, which means copycat operators now have a blueprint too. The safest assumption is that this playbook — email, call, fake app, seed phrase, Telegram — keeps circulating well after Operation Asterix itself is shut down.