Operation Asterix: Phishing Campaign Targets 885,000 Phone Numbers, Hits Binance Users

A large-scale cryptocurrency phishing campaign dubbed “Operation Asterix” has compromised approximately 885,000 phone numbers, with 5,576 of them linked to Binance user accounts and flagged as direct attack targets, according to a report by cybersecurity firm Rapid7, as cited by Cointelegraph.

How the Attack Works

The attackers deployed fake mobile applications impersonating popular hardware and software wallets, including Ledger, Trezor, and Exodus. These counterfeit apps were distributed through unofficial channels and designed to trick users into entering their recovery seed phrases, which the attackers then harvested. In addition to the fake apps, the campaign used bogus customer service emails and phone calls to further social-engineer victims into revealing sensitive information.

Rapid7’s investigation also uncovered a bulk phone number verification tool that specifically targeted Kraken accounts, indicating a broad and systematic approach to compromising cryptocurrency holders. The use of AI tools appears to have played a significant role in automating parts of the phishing process, making the campaign more scalable and harder to detect.

Implications for Crypto Users

This incident highlights the growing sophistication of phishing attacks in the cryptocurrency space. Unlike traditional phishing that relies on mass email blasts, Operation Asterix demonstrates a targeted strategy that leverages phone numbers and fake applications to build trust. For Binance users, the matching of phone numbers to accounts suggests that the attackers had access to or had previously obtained personal data, possibly through other breaches or data leaks.

The use of AI tools is particularly concerning, as it allows attackers to craft convincing phishing messages and automate interactions with victims at scale. This reduces the likelihood of detection and increases the chances of success.

What Users Should Do

Users who believe they may have been affected should immediately move their funds to a new wallet with a fresh seed phrase, enable two-factor authentication (2FA) using a hardware key or authenticator app, and be cautious of any unsolicited communication requesting sensitive information. It is also advisable to only download wallet apps from official app stores or directly from the provider’s website.

Conclusion

Operation Asterix serves as a stark reminder of the persistent and evolving threats in the cryptocurrency ecosystem. With hundreds of thousands of phone numbers compromised and a significant number of Binance accounts targeted, the need for robust personal security practices has never been more critical. Staying informed about such campaigns and adopting a zero-trust approach to unsolicited communications can help mitigate the risk of falling victim to these sophisticated attacks.

FAQs

Q1: What is Operation Asterix?
Operation Asterix is a cryptocurrency phishing campaign identified by Rapid7 that targeted around 885,000 phone numbers, with 5,576 associated with Binance accounts. It used fake wallet apps and social engineering to steal seed phrases.

Q2: How did the attackers target Binance users?
The attackers used fake apps impersonating Ledger, Trezor, and Exodus, along with bogus customer service emails and phone calls, to trick users into revealing their seed phrases. A bulk phone number verification tool also targeted Kraken accounts.

Q3: What should I do if I think I’m affected?
Immediately transfer your crypto assets to a new wallet with a fresh seed phrase, enable two-factor authentication, and avoid responding to unsolicited requests for personal information. Only download wallet apps from official sources.