Rapid7 Issues Fake Wallet Warning: 885,000 Phone Numbers Used to Target Recovery Phrases

Rapid7 announced that approximately 885,000 phone numbers were scanned in a campaign dubbed Operation ASTERIX, targeting recovery phrases through fake wallet apps and phishing methods.

According to the disclosure by cybersecurity firm Rapid7, attackers collected mass phone lists to reach crypto users and filtered these numbers using account verification tools. Subsequently, they enriched targets’ personal information to make fake customer support calls more convincing. Thus, a vast data pool was transformed into a more selective attack list targeting individuals with crypto accounts.

The attack flow began with phishing emails containing fraudulent messages and vishing calls based on phone deception. After impersonating support staff, the attackers directed users to fake Trezor, Ledger, and Exodus applications. These apps were used to capture recovery phrases and put users’ assets at risk. Stolen data was transferred to the attackers’ Telegram channel in the final stage of the flow.

Fake wallet applications targeted recovery phrases

In the German dataset examined by Rapid7, 43,066 Crypto.com accounts were identified out of 316,002 phone numbers. Operators then enriched the verified targets with personal information, strengthening attacks based on support impersonation.

Another notable element of the campaign was the attackers’ use of GitHub Copilot and Claude Code. These tools were used to process target data, develop and debug malware, and set up phishing infrastructure. When Claude refused code obfuscation requests, the operator switched to Kimi and attempted to bypass security controls with a custom jailbreak command. Rapid7 could not verify if this attempt was successful.

Although the findings demonstrate the scale of the campaign, the total verified loss or number of victims was not disclosed. Users should only download wallet applications from the developers’ official sources.