Operation ASTERIX: How a Fake Support Call Delivers a Counterfeit Wallet App

If someone calls you, knows your name and your email address and asks you to reinstall a wallet application, then the call is in all likelihood the attack itself. That is exactly the pattern the security firm Rapid7 describes in a report dated August 17, 2026, under the name Operation ASTERIX. The core of it for readers in Germany sits in a single figure: the largest file secured held 316,002 German mobile numbers.

The case is notable because it wires together three attack routes that usually appear separately. A phone system dials automatically. An email supplies the pretext. And at the end sits a program that looks like the familiar wallet software and asks for the recovery words. Once you have understood this chain, you can spot it at the point where it breaks.

Operation ASTERIX Explained: What Rapid7 Found on an Open Server

Operation ASTERIX is the name for a fraud chain that combines phone calls, phishing emails and counterfeit wallet programs into a single sequence. The analysts assigned the name themselves: the server was running Asterisk, an open-source phone system, and that formed the backbone of the calls.

The server was found because its operators made a mistake. According to Rapid7, a web directory on port 8080 was reachable without any login and listed its contents openly. Inside were phone number datasets, account-checking tools, ready-made installation packages for the counterfeit programs, phishing interfaces, dialling scripts and session logs from the language models in use. Rapid7 says it reported the findings to Apple's security team among others and worked with those involved on countermeasures.

A find of this completeness is rare. Usually you see only the part of a campaign that reaches the victim. Here the workbench lay open.

316,002 German Mobile Numbers: Why Germany Was the Largest Single Item

In total the datasets found covered around 885,000 phone numbers from several regions. Alongside Germany, the report names Hong Kong, Bulgaria, the United Kingdom, the United States and a Canadian financial services provider. For users of one well-known hardware wallet brand there were an additional 54 files sorted by country.

The German file was the largest single one. That does not mean 316,002 people in Germany were called. It means their numbers were on hand as a starting pool. The distinction matters and is picked up again further down, because it determines how large this campaign actually was.

Where the numbers came from, the report does not say. Datasets of this order have been circulating for years from data breaches at retailers, shipping providers and online services. For your defences the origin is irrelevant: a phone number cannot be recalled.

A 13.6 Percent Hit Rate: How Crypto Accounts Are Filtered Out of Phone Numbers

The real trick happens before the first call. The operators ran automated checking tools against the login function of a large trading venue and established in that way which number holds an account there. The method exploits the fact that many services answer a login attempt differently depending on whether a number is registered.

According to the figures in the report, the hit rate in the German dataset was 13.6 percent. That turned the 316,002 numbers into 43,066 confirmed accounts. Roughly every seventh number belonged to an active user.

For the attackers this is a question of efficiency. Instead of calling hundreds of thousands of people and meeting blank incomprehension from most of them, they are left with a list on which everyone called knows the product being discussed. That makes the call plausible before a single word has been spoken.

Vishing Instead of Email: How the Call Is Placed Through a Phone System

Vishing means phishing by voice call: the fraud attempt runs over the telephone rather than by email. On the server Rapid7 found the full kit for it, including the Asterisk and 3CX phone systems as well as several scripts for automated dialling and for coordination with the rest of the infrastructure.

The effect comes from the preparation. Whoever calls can, according to the report, state the name of the person called, the email address, the location and details about the account. That is not magic but the result of the upstream check and the datasets. To the person called it looks like a call back from the provider, with the staff member holding the file.

Then comes the pretext. There is a security problem, a suspicious login, a necessary update. The solution offered is always the same: install an application, available by email or through a link that is named.

Counterfeit Trezor Suite, Ledger Live and Exodus: Which Wallet Programs Were Cloned

Rapid7 secured three counterfeit applications. They are fakes of Trezor Suite, Ledger Live and Exodus, each as an installation package for Windows and macOS, and in the case of the Trezor fake separately for Intel and Arm processors.

The point often misunderstood here: the makers of these programs are the ones being impersonated in this case. Neither their devices nor their genuine applications were attacked. What was cloned is the interface, meaning what you see on the screen. The attack takes place at the moment you type your words into a window that merely looks like the familiar one.

The Double Entry Trick: Why the Fake App Fakes an Error

The most interesting detail in the report is a small piece of nastiness in the sequence. The counterfeit Trezor application accepts recovery phrases of 12, 18, 20 or 24 words, plus an additional passphrase on request. After the first entry it displays an invented validation error and asks for the words again.

This serves the perpetrators' quality control. Anyone typing out a recovery phrase makes typing errors easily, and a single wrong word makes the haul worthless. The faked error ensures that the second entry is made more carefully and that both versions can be compared.

If you know this behaviour, you have a very clear warning sign to hand. A genuine wallet application does not ask you to enter your recovery words during normal operation. Those words are needed only when setting up a device or restoring it after a loss, and then on the device itself.

Seed Phrase via Telegram Bot: Where the Recovery Words Drain Away To

The seed phrase, also called the recovery phrase, is the sequence of words from which all of a wallet's keys can be recalculated. Whoever holds it holds the balance, regardless of where the device happens to be.

According to Rapid7's analysis, the counterfeit application packs the word sequence, the optional passphrase and the computer's IP address into a single message and sends it to a Telegram bot. The message carries a header naming its contents. The exfiltration is therefore organised immediately and without the detour of the attackers' own server.

In practice that means: between the entry and the attackers' access lie seconds, not hours. There is no way to revoke it. How to store a recovery phrase instead, without ever typing it into a text field, we have described in a separate article on storing your seed phrase safely.

Trojanised Installer: How a Fake Tool Ships the Wrong Wallet With It

One find falls outside the usual pattern. Alongside the three wallet fakes, the server held a manipulated installation program that passes itself off as a developer tool while shipping the counterfeit Ledger Live application with it.

That shifts the target group. Those addressed are no longer only investors reacting to a support call, but also technically adept users who download software from search results or advertisements. This group in particular considers itself less at risk, because it recognises the classic phishing emails.

For you that yields a simple rule, made concrete in the section on sources further down: an installation package is only as trustworthy as the route by which you obtained it.

AI Tools in the Attack Kit: What the Session Logs Show

Because the operators left their working environment lying open, the logs of their language model sessions have survived as well. Rapid7 describes the tools as having been used for ordinary developer work: writing scripts, preparing data, packaging applications, setting up infrastructure.

The report assigns the tasks to different providers. A programming assistant is said to have helped with development in the background, and a further tool with managing and cleaning the number lists, among them a holding of more than 103,000 Polish phone numbers. When it came to obfuscating malicious code, the request was refused, whereupon the operators switched to another model and attempted a workaround there. Whether that attempt succeeded cannot be established, according to Rapid7.

For context it matters what is proven here and what is not. What is proven is that the attackers used such tools for preparation. What is not proven is that these tools were what made the attack possible in the first place. Phone systems, number lists and cloned interfaces existed long before; the logs mainly show how much effort falls away when routine work is handed to a machine.

Only 20 Queries and Six Emails: Why the Campaign Was Smaller Than the Numbers Suggest

At this point a figure belongs in the text that contradicts the headline. In one of the phishing interfaces, according to Rapid7, only 20 successful data queries and six phishing emails sent were logged over a period of around two weeks.

That is not a mass mailing. It points to a campaign under construction, or to a deliberately small, targeted selection. The 885,000 numbers therefore describe the potential of the stock, not the number of people affected. Anyone turning that into a report about hundreds of thousands of harmed investors is overstating the finding.

The relevance for you does not change much because of it, though. The blueprint is documented, the tools are assembled, and the preparatory work in the form of checked account lists has been done. Infrastructure like this is rarely shut down; it changes operator.

A Fake Support Call: How to Recognise One During the Conversation

There are a handful of markers that hold regardless of the provider and that you can memorise for the moment it matters.

• Nobody calls you whom you have not called. Trading venues and wallet manufacturers work through ticket systems, not through outbound calls to private customers.
• The caller knows your details. That is no proof of authenticity but, after this case, rather a warning sign, because checked lists are the starting point.
• Time pressure builds. An access supposedly under way, a block within minutes, an update that has to happen immediately.
• At the end there is always an installation or an entry. That is precisely the purpose of the conversation.
• The call-back route is circumvented. Anyone genuine has no objection to you hanging up and getting in touch yourself via the official address.

The last point is the most robust. Hang up, find your provider's contact page through your own browser history or bookmark, and ask there. A genuine matter survives a call back; a fraud attempt does not.

The same basic rule applies to the email variant of the scam, in which a supposed withdrawal request lands in your inbox. How to recognise that is set out in our article on counterfeit withdrawal requests.

Checking a Wallet App: Where the Genuine Programs Actually Sit

Because three well-known applications were cloned in this case, the routes by which they are obtained are worth a look. We called up the obvious addresses ourselves on August 22, 2026 at around 19:00 UTC, to see where a user actually lands.

The result is inconsistent. The official page for Trezor Suite answered directly and led to the program. The obvious address for Ledger Live, by contrast, redirected to the manufacturer's shop area, so not to a pure download page. With Exodus the automated call to the download address was refused, while the main page answered normally. That refusal is a protection mechanism against bots and says nothing about reachability in a browser.

Where to Get Wallet Software: What That Means for You in Practice

If even the direct route to the manufacturer redirects, the likelihood is high that users will search instead. And search results and paid advertisements have for years been the most convenient distribution route for cloned applications. So set a bookmark to the manufacturer's page while you have reached it safely, and use only that from then on. If you are facing the choice of a device, you will find the providers together with their official sources in our hardware wallet comparison.

Seed Phrase Entered: What Counts in the First Few Minutes

If you have typed a recovery phrase into a program whose origin you cannot establish with certainty, the wallet counts as compromised. Not as possibly at risk, but as open.

The order of steps is then unambiguous. On a device you trust, set up a new wallet with a new recovery phrase. Transfer the balance there, starting with the largest holding. Only after that check what else might be affected, such as identical passwords or linked accounts at trading venues. Changing a wallet's password does not help at this point, because the words themselves are the access.

Document the process in parallel: time, application, origin of the file, transaction identifiers. You will need these details for a police report and for the later tax treatment of a loss, and after the fact they are hard to reconstruct.

Spotting a Fake Wallet App: What to Take Away

1. Treat every unsolicited call about your crypto account as a fraud attempt. Hang up and get in touch by a route you know yourself. If in doing so you discover that your provider runs no telephone support at all, you already have your answer. Which trading venues are authorised in the EU and how to find their genuine contact routes is shown in our overview of regulated crypto exchanges.
2. Obtain wallet software exclusively through a bookmark you have set yourself. Not through search hits, not through advertisements, not through a link from a conversation. An overview of the common applications together with manufacturer details is in the software wallet comparison.
3. Do not enter your recovery phrase into any program that asks for it during normal operation. Those words belong on the device when setting up or restoring, and nowhere else. Which device confirms the entry on its own display and thereby secures the decisive intermediate step is set out in the hardware wallet comparison.

The report itself is publicly available and is the basis for all the details in this article: Rapid7 Labs on Operation ASTERIX.

(As of August 22, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)