CRYPTO FRAUD PIPELINE - FORENSIC BREAKDOWN

The call already knew you own crypto. That part was checked in advance.

Rapid7 mapped a campaign that collected around 885,000 phone numbers, tested which ones belonged to people with exchange accounts, and only then started dialling. What arrives afterwards is a wallet app that shuts down the real one.

SB

SafeBrowz Threat Research Security Research · 21 August 2026 · 11 min read

The number that explains the phone call

Rapid7 Labs published its analysis of the campaign, which it calls Operation ASTERIX, on 17 August 2026. The detail that reframes everything else sits in the targeting.

The operators accumulated roughly 885,000 phone numbers across several countries. The largest single file held 316,002 German mobile numbers. They did not simply dial through it. They ran the numbers against cryptocurrency exchange checks to see which ones already corresponded to accounts, and 43,066 came back confirmed. That is a hit rate of about 13.6 percent, and it turns a directory into a target list. Other files covered Hong Kong, Bulgaria, the United Kingdom, the United States and Canada, alongside 54 country files of Ledger-associated users. Rapid7 names Crypto.com and Kraken among the services checked against.

So when someone rings and speaks as though they know you hold crypto, they are working from a line that has already been verified. That is worth internalising, because the instinctive reaction, that they must be legitimate or how else would they know, is exactly the reaction the validation step was bought to produce.

Why the validation step matters more than the script

Most scam calls are volume plays. The caller knows nothing, opens vague, and lets you fill in the details. You can hear it, and most people hang up.

A validated list removes that tell. Every person picking up is someone with an exchange account, so the caller can be specific immediately and never has to fish. It also changes the economics. When one call in eight reaches a real crypto holder rather than one in a thousand, an operation can afford patience: a longer conversation, a follow-up, a support persona that behaves like support.

The practical consequence for you is uncomfortable but simple. The old heuristic, they must be real because they knew, is now the weakest signal you have. Someone knowing you hold crypto tells you a list exists. It tells you nothing about who is calling.

The payload: a wallet app that closes the real one

The call is the introduction. The theft happens in software.

Rapid7 documented counterfeit builds of three wallet applications, distributed through fake documentation pages, trojanised installers and counterfeit app stores. The counterfeit Trezor Suite is the one worth studying, because of what it does on the machine: it terminates the process of the legitimate application and puts its own interface in that place, which then requests the recovery phrase. On macOS it installs persistence through LaunchAgents, so it comes back after a restart.

Sit with that sequence for a second. You are not on a website you were suspicious of. You opened the wallet software you already had. The window that appears belongs to the application you trust, in the place you expected it, and it asks for the phrase. Every instinct built around spotting a fake page is looking in the wrong direction, because there is no page.

Rapid7 also notes the exfiltration path was a Telegram channel, with the harvested data carrying the header "TREZOR SECRET PHRASE". No ambiguity about the purpose.

Three brands, two operating systems

The counterfeits covered Trezor Suite, Ledger Live and Exodus, built for both macOS and Windows. Those are three of the most widely used wallet applications, and the choice is not about which is weakest. It is about which names a person searching for a download or a support page will type.

The real ones live at trezor.io, ledger.com and exodus.com. That short list is the whole defence for this stage, and it works only if you type the address yourself. A search result, an advertisement, a support page you were sent, or a link read out on a call are all the same category of thing here: a route someone else chose for you.

The AI part, told accurately

Rapid7 recovered evidence from the operator's own server showing AI coding assistants used throughout the build. GitHub Copilot for backend development. Claude Code for operational scripting and managing the lead lists. Then, for code obfuscation, a switch to a third model after Claude declined the request, accompanied by a jailbreak prompt that tried to override the safety controls through identity replacement, trigger-phrase conditioning and reasoning-trace poisoning.

It is worth reading that carefully rather than dramatically. The interesting fact is not that AI was used. It is that a refusal happened, the operator had to notice it, and then had to spend effort routing around it. That is what a working control looks like from the attacker's side: not a wall, but a cost.

What it changes for you is the pace and the polish. Campaigns get assembled faster and the artefacts look more finished, so proofreading is no longer a defence. What has not changed by a single degree is the ask. The request at the end is still your recovery phrase, and that request has been the tell since long before any of these tools existed.

Where a list of crypto owners with phone numbers comes from

One of the datasets Rapid7 describes is made of Ledger-associated users across 54 country files, which is worth pausing on given the last two weeks.

We wrote on 18 August about the SafePal and Trezor customer data exposure, where 53,487 hardware wallet buyers had names, addresses and, for most of them, phone numbers exposed through a fulfilment partner. The point we made then was that a shipping list is worth more than a password dump, because it identifies people who plausibly hold crypto and says how to reach them.

This campaign is what that looks like once someone acts on it. We are not claiming these specific lists came from those specific breaches, and Rapid7 does not say so either. What the two stories show together is the pipeline: a customer list leaks, and separately, operations exist whose entire opening move is turning exactly that kind of list into validated targets. Ledger owners have lived this since their own customer database leaked years ago, which is why printed letters with QR codes still arrive at their homes.

The indicators Rapid7 published

The three domains below are blocked for SafeBrowz users. Two of them no longer resolve and one points at a null address, which is normal for infrastructure that has been reported; it is not a reason to leave them unblocked, because dormant infrastructure gets pointed at something live again.

• macos-claude[.]com - note the shape of it, a security-adjacent brand name bolted to an operating system, which is what makes a download page look official at a glance.
• ledgerhelp[.]com - a domain first registered in 2016, old enough that age-based reputation checks read it as established.
• 36mcrypto[.]com
• Infrastructure addresses 82.25.35.77, 82.25.35.200 and 31.57.35.88.
• Exfiltration to a Telegram channel, with harvested data labelled "TREZOR SECRET PHRASE".

The second one deserves a note. An attacker holding a domain registered a decade ago defeats one of the most common shortcuts in this field, which is treating a young domain as suspicious and an old one as settled. Age tells you when a name was bought. It does not tell you who holds it now.

If you typed your phrase into one of these

1. Move the funds before anything else. Create a new wallet on a device you trust, with a newly generated recovery phrase, and transfer everything across. A recovery phrase cannot be rotated or revoked, so the only fix is a new one.
2. Do not reuse the old phrase anywhere, ever. Not on a spare wallet, not as a backup. Treat it as public.
3. Remove the software, then check what restarts it. On macOS look for a LaunchAgent that brings it back after a reboot. Deleting the application alone may not be enough.
4. Reinstall the real client from the vendor's own domain, typed by hand, not from your browser history or a saved link, either of which may be how you got here.
5. Expect a follow-up. A recovery call offering to help you retrieve what was taken is a standard second act, and it is the same people. There is more on that in what to do after a scam.

Five checks that hold even when the call sounds right

1. The phrase is the line. No vendor, no exchange, no support agent, no migration, no security check ever needs your recovery phrase. There is no exception, so you never have to judge one.
2. Knowing about you proves nothing. Your name, your phone, the wallet you own: all of it can be bought or matched. Treat it as neutral.
3. End the call and start your own. If it might be real, hang up and reach the company through a number or app you already had. The person who called cannot follow you there.
4. Type the download address. Search results, ads and sent links all put someone else in charge of where you land.
5. A prompt inside familiar software is still a prompt. This campaign proves the window can be counterfeit even when the application was genuine yesterday.

Where a link check helps, and where it plainly does not

Being straight about this matters more than usual, because this campaign runs through channels a browser tool does not touch.

A phone call has no link in it. An installer already downloaded and running is outside what an extension can see. If those are the stages you are at, the checks above are the defence, and nothing on this page changes that.

What is checkable is the step in between, which is where most victims actually pass through: the page you were sent to in order to get the download. Layer 1 reads the shape of a link in the browser before the page renders. Layer 2 checks the destination server-side against reputation feeds, a brand database of more than 550 names and our blocklist, which is where the three domains above now sit, added as soon as Rapid7 published them. Layer 3 is the AI deep scan, a Premium feature with one free scan a day for everyone else, reading what a page actually serves, which is how a counterfeit vendor download page gets judged on what it is rather than on whose logo it wears.

The honest summary: we can help you not arrive at the installer. Once it is on the machine, this becomes a question of what you type next, and the answer to that has to be nothing.