Crypto-phishing campaign targeting 885,000 phone numbers uncovered!

[cygan]

researchers at Rapid7 apparently stumbled upon a crypto scam campaign that was still active at the time of discovery due to a mistake made by the scammers!
there were approximately 885,000 phone numbers on the server. the largest share (316,002 phone numbers) came from germany. of these, 43,066 (about 13.6%) could apparently be linked to a crypto account.
Rapid7 published the report^[1] earlier this week and has already forwarded its findings to the affected providers and authorities.
btw dont follow any links or instructions if you are contacted unsolicited by someone claiming to be from Ledger, Trezor, Binance, Kraken, or Crypto.com support regarding a security issue.
and never share your seed phrase with a support representative!

for example, here is the phishing scheme, how the scammers operate:



[1]: https://www.rapid7.com/blog/post/tr-operation-asterix-crypto-fraud-vishing-phishing/

[Antidote47k]

This is a reminder that seed phrases aren’t the only things attackers are after. A phone number or email may seem harmless on its own but if the attacker knows it belongs to someone who uses a particular crypto service, that helps narrow things down and they can come up with targeted phishing attacks. They might not necessarily need to hack your bitcoin or exchange directly, the goal is to convince you that there is a problem with your account and gradually lull you into revealing informations they need or to take actions that would enable them.

I’m also wondering if the recent coldcard incident has made further phishing easier to pull off. The coldcard incident has  made people concerned about security, so a message claiming their wallet needs an urgent update or security check is sounding much more believable. Regardless if users receive such messages it’s always safer to avoid such links or contact provided in the message, if such update exists then it should be on the official site or service where you can go and verify yourself

[bitbollo]

...
I’m also wondering if the recent coldcard incident has made this kind of phishing easier to pull off.
...

if you search with pwned or other database about breaches you can find thousands of email address/relevant data that can easily used to track many users on crypto space.
This doesn't allow to know if they are using a specific service, but generally we have only few major exchanges/hardware wallets provider so it would be so hard to guess a service you're already using.

to avoid issues - use esim - creates as many numbers as you can (worldwide).
share these numbers with different groups or services (aka not the same number for all users).
in case you receive a call or message, even if "yes they are really reaching me" just login and check the main site. no rushing, no expert, just login.

[pawanjain]

researchers at Rapid7 apparently stumbled upon a crypto scam campaign that was still active at the time of discovery due to a mistake made by the scammers!
there were approximately 885,000 phone numbers on the server. the largest share (316,002 phone numbers) came from germany. of these, 43,066 (about 13.6%) could apparently be linked to a crypto account.
Rapid7 published the report^[1] earlier this week and has already forwarded its findings to the affected providers and authorities.
btw dont follow any links or instructions if you are contacted unsolicited by someone claiming to be from Ledger, Trezor, Binance, Kraken, or Crypto.com support regarding a security issue.
and never share your seed phrase with a support representative!

for example, here is the phishing scheme, how the scammers operate:
snip

[1]: https://www.rapid7.com/blog/post/tr-operation-asterix-crypto-fraud-vishing-phishing/

Scammers are way too advanced these days. I came across a similar story on social media recently.
A scammer portrays himself as bank person and first sends a message to the victim with an OTP and then calls the victim and tells him the OTP.
Somehow the victim gets convinced since the scammer tells him the OTP and ends up getting scammed.
It's crazy to see how far scammers can go with their frauds and scam innocent people of their life savings.
Stay vigilant and staying aware has now become a necessity.

[Z-tight]

I’m also wondering if the recent coldcard incident has made this kind of phishing easier to pull off. The incident has  made people concerned about security, so a message claiming their wallet needs an urgent update or security check is sounding much more believable.

Not necessarily. I understand that a few people in the community right now seem unsure of what's safe and not, and any security update or announcement, could get them more worried than they'd have been if Coinkite didn't fuck up. However, that shouldn't transcend into one exposing their seed phrase to scammers, and anybody who falls for that always had the tendency to do so, maybe due to ignorance or their inability pause and think when they receive unsolicited messages.

Scammers are way too advanced these days.

Many of these tricks have existed for a very long time, very few scams are sophisticated attacks.

[Faisal2202]

This is a reminder that seed phrases aren’t the only things attackers are after. A phone number or email may seem harmless on its own but if the attacker knows it belongs to someone who uses a particular crypto service, that helps narrow things down and they can come up with targeted phishing attacks. They might not necessarily need to hack your bitcoin or exchange directly, the goal is to convince you that there is a problem with your account and gradually lull you into revealing informations they need or to take actions that would enable them.

They are after you. They contact you via phone numbers and emails. Once they know you hold coins, if they know I hold coins in CEXs, they will contact me, they will profile me and choose a scheme to contact me, discuss the matter with me, and take me into their trust that they are genuine and something is wrong with my funds on the CEXs.

So, brother, they are after our seed phrases in other cases. Here, with this information, they are after your exchange credentials, or they can ask for many other pieces of information that can lead them to your funds easily.

I’m also wondering if the recent coldcard incident has made this kind of phishing easier to pull off. The incident has  made people concerned about security, so a message claiming their wallet needs an urgent update or security check is sounding much more believable. Regardless if users receive such messages it’s always safer to avoid such links or contact provided in the message, if such update exists then it should be on the official site or service where you can go and verify yourself

How does the Coldcard wallet have anything to do with phishing scams like this? Automation has always been in use by these hackers, and if they have automated their operations using AI to scam you, it has nothing to do with the Coldcard wallet hack. Instead, you can say the Ledger, Trezor, and SafePal wallet owners lost their data due to breaches in third party products. For Ledger and Trezor, it was the shipment company that lost everyone's data. For SafePal, it was the plugin they were using. This is not it, there have been several breaches in different companies where people lose their IDs, numbers and emails + home addresses.

This all started due to this, not because of Coldcard. As a matter of fact, I think due to the Coldcard event, BTC developers are now showing some real interest in using AI to secure the BTC ecosystem. This step might not have been taken by them unless an event like this had forced them.

BPI has also asked for support from all the AI frontier to help the developers with their AI models so they can make the ecosystem more secure.

[fwman]

At this point, all ones(specially who have cryptos) should assume that their phone numbers are in the list of scammers and watch out every unknown call. Unfortunately, the attach surfaces got wider and wider with AI tools.

[noorman0]

-snip-
How does the Coldcard wallet have anything to do with phishing scams like this?

Perhaps what op meant is that if scammers happen to obtain the contact details of a Coldcard wallet owner, they could offer some form of fund recovery and then target the victim's remaining assets.

[Cookdata]

This is a reminder that seed phrases aren’t the only things attackers are after. A phone number or email may seem harmless on its own but if the attacker knows it belongs to someone who uses a particular crypto service, that helps narrow things down and they can come up with targeted phishing attacks. They might not necessarily need to hack your bitcoin or exchange directly, the goal is to convince you that there is a problem with your account and gradually lull you into revealing informations they need or to take actions that would enable them.

If you read between lines, this is a phone numbers phishing and not Coldcard like you put it. If you observe carefully, since the beginning of this month, users informations that bought hardware wallet were leak,Trezor customers data exposed , safepal wallet customers data, most of the informations are phone numbers, house location for shipment, and basic details about customers, any bad actor with these details can target them. Similarly, with these phones numbers, they can target anyone on with the numbers,  like disguise as a Trezor customer support to offer wallet upgrade, it could be be any company like Binance, Kucoin, just know that anything is possible with scammers.

I’m also wondering if the recent coldcard incident has made this kind of phishing easier to pull off. The incident has  made people concerned about security, so a message claiming their wallet needs an urgent update or security check is sounding much more believable. Regardless if users receive such messages it’s always safer to avoid such links or contact provided in the message, if such update exists then it should be on the official site or service where you can go and verify yourself

Again you are missing road. Coldcard was security exploit, the attackers found possibilities of private keys because of small possibilities from the entropy, it was never about customers data.
This is not a comparison of risk but I think some of the people that lost their Bitcoin to the hackers, they would have prefer a data lost than their Bitcoin that was stolen from them, the two are different risk.

[Nothingtodo]

One thing to keep in mind in the world of digital currency is that if someone asks you to know the security seed phase of your wallet from a third party or asks you to connect your wallet to a phishing website, then it is Hundred Percent sure that those third parties will cheat you. Remember that when someone in the world asks you to know the security seed phase of your wallet, it will be none other than a hacker or scammer. Remember that no real person will cheat you and they will never ask you to know your password or the security seed phase of your wallet.

[Floxynice]

Scammers are way too advanced these days. I came across a similar story on social media recently.
A scammer portrays himself as bank person and first sends a message to the victim with an OTP and then calls the victim and tells him the OTP.
Somehow the victim gets convinced since the scammer tells him the OTP and ends up getting scammed.
It's crazy to see how far scammers can go with their frauds and scam innocent people of their life savings.
Stay vigilant and staying aware has now become a necessity.

This kind of scam is not new. Our phone numbers are public data, anyone can see it and even put calls accross if they want to. Few years back and even till date, scammers have been scamming people using phone numbers and other public data available to them. I have gotten OTPs too on my mobile device, got phone calls from scammers and was asked to resend messages sent to my mobile phone or give them information that will help them fix my account.

Many people have been victims of this. But the good thing right now is that there is awareness now that people can get scammed just  by attending to impersonators who call, text or send them emails.

Whenever we get any message from any trusted service provider, it is good to check their official websites for confirmation. It won't cost anything to check for authenticity.

[hmbdofficial]

to avoid issues - use esim - creates as many numbers as you can (worldwide).

I don’t get it does using an eSIM change the fact that that you could be reached via text or email if your data is leaked out?

I’m also wondering if the recent coldcard incident has made this kind of phishing easier to pull off. The incident has  made people concerned about security, so a message claiming their wallet needs an urgent update or security check is sounding much more believable. Regardless if users receive such messages it’s always safer to avoid such links or contact provided in the message, if such update exists then it should be on the official site or service where you can go and verify yourself

If you relate this scenario with that off trezor it would have made more sense, because it was the trezor incident that has to with data breach. But the coldcard is unrelated here since it was firmware bug that lead to weak entropy generation. It wasn’t a data leak or phishing either.

[Antidote47k]

How does the Coldcard wallet have anything to do with phishing scams like this? Automation has always been in use by these hackers, and if they have automated their operations using AI to scam you, it has nothing to do with the Coldcard wallet hack.

You’re right, coldcard incident has nothing to do with this attack but if you read the follow up sentence you would understand why i mentioned it. I was insinuating if the coldcard recent incident could influence people to fall for further phishing attacks after the attackers have their numbers.

~snip

I think you’re misunderstanding my point, yeah, it’s a phone number phishing attack, I think that has been established and we both agree on the fact that attackers can use these numbers to pose as customer support or other agents to scam people. The only time I related anythihg to the coldcard incident was whether the incident could serve as motivation for people to fall for such scams, I mean even though it has been a while now I’m sure it’s still fresh in most of our memories, so everyone is more conscious about security now more than ever, so when some sees emails or messages regarding security update they might ignorantly fall for further scams in the process of trying to secure their accounts which is quite ironical.

[bitbollo]

I don’t get it does using an eSIM change the fact that that you could be reaching via text or email if you data leaked out?

similarly of what we are doing with email in some cases = 1 email for each service if possible. the same could be done with eSIM.
even if these data are leaked these are "standalone" can't be used with other data. it could be easier with an eSIM to have a number for each service...
Likewise if you have a number from a foreigner country A using a service from country B, I am pretty sure it become more easy to detect fake calls. But in general the quickest solution would be just to check the main site.

[Felicity_Tide]

Scammers are way too advanced these days. I came across a similar story on social media recently.
A scammer portrays himself as bank person and first sends a message to the victim with an OTP and then calls the victim and tells him the OTP.
Somehow the victim gets convinced since the scammer tells him the OTP and ends up getting scammed.
It's crazy to see how far scammers can go with their frauds and scam innocent people of their life savings.
Stay vigilant and staying aware has now become a necessity.

OTP scams are quite common, but this very one does not entirely portray how it works, at least from what I already know.
Afaik, scammers don't actually send the OTP. What they do is, they try to access a particular service that is being used by their victims with the available data they already have_{(phone number or something else)}. Then that particular service sends the OTP to the actual user of that service_{(the victim)} because it's actually a security measure for anyone who's trying to gain access. Then the scammer makes the call to the victim, and pretends to work for that particular service. But in a case where the scammer already has the OTP, I don't see the point of contacting the victim unless there's more to the story.

[ZAINmalik75]

Many of these tricks have existed for a very long time, very few scams are sophisticated attacks.

Actually, this method of first sending a message or an email and then calling the victim to confirm the code is new in the market, and this is being used by scammers worldwide because just a few days back, I saw a post on Facebook where a person was saying that a friend of his got scammed using the same method, but a little bit different. The scammer first sent a message with the code, then called the victim through a number that is generally used by that company, and the scammer said the code and asked for confirmation, the guy told him the OTP, but then the caller said it expired and a new one will be sent and he should tell him, the victim did it because by that time he thought it's actually support.

There is no doubt that scammers are getting smarter day by day. I know that they still use some of the old methods to see if they work and they do on some people, but they also come up with new methods and ideas of scamming people and some of the methods they use are actually pretty sophisticated and that's why dangerous, because the victim barely understands anything until the scammer does the work and vanishes like thin air and then the victim realizes what just happened when they see an empty wallet or account.

[Churchillvv]

This is a reminder that seed phrases aren’t the only things attackers are after.

This is more than a reminder, it’s now a warning number xxx. The highest data anyone needs to find you is email and phone number having been used in several services, you’re then vulnerable to whatever attack they may come up with. For this it’s a well known scam method but usually spread across where there is less awareness, since Germany has less awareness on this so this guys just spread mails across and if it finds someone vulnerable then they can fest on that person.

[Zlantann]

Among the artifacts was evidence that the operator relied on AI coding assistants throughout the campaign's development; recovered prompts, shell history, and project files show AI being used to package Electron applications, obfuscate code, troubleshoot builds, modify phishing infrastructure, and prepare malware for distribution.

AI is helping scammers to develop and execute different types of scam packages that are difficult to detect. Thankfully, some good guys are also using AI to tackle these challenges. We have to be vigilant because more of these scams will keep showing up with the help of AI.

This is a reminder that seed phrases aren’t the only things attackers are after.

This is more than a reminder, it’s now a warning number xxx. The highest data anyone needs to find you is email and phone number having been used in several services, you’re then vulnerable to whatever attack they may come up with. For this it’s a well known scam method but usually spread across where there is less awareness, since Germany has less awareness on this so this guys just spread mails across and if it finds someone vulnerable then they can fest on that person.

When some of these centralised platforms suffer from a data breach, they wouldn't inform the victims. Whenever users' data is stolen, it is kept secret to protect the name or reputation of such an organisation. This secrecy causes people to be prone to scams since they are not aware that their data has been collected by scammers.

[Jewan420]

I often get calls from scammers, but I never answer them. Some calls are automatically rejected by my device using its security system and some calls I reject manually. Since the security system is enabled on the device, the numbers are marked as spam calls and keep warning me. I still don't know what will happen if I receive the calls!

But I am so careful that if someone ever asks for something secret like a seed or OTP, I should not hesitate to mark it as a scam. Since I never receive the calls, I am not too worried yet. The numbers are also relatively easy to identify, I almost always get calls from numbers that start with +1 and the number pattern is also the same. It is best to ignore such calls and emails as much as possible, especially before clicking on the link.

[coinlary]

Many of these tricks have existed for a very long time, very few scams are sophisticated attacks.

Actually, this method of first sending a message or an email and then calling the victim to confirm the code is new in the market, and this is being used by scammers worldwide because just a few days back, I saw a post on Facebook where a person was saying that a friend of his got scammed using the same method, but a little bit different. The scammer first sent a message with the code, then called the victim through a number that is generally used by that company, and the scammer said the code and asked for confirmation, the guy told him the OTP, but then the caller said it expired and a new one will be sent and he should tell him, the victim did it because by that time he thought it's actually support.
There is no doubt that scammers are getting smarter day by day.

Not really, thiis one specifically  is common, I'm surprised  there're still some people who aren't aware of the famous scam method and this thing is  global . It's usually a password reset OTP or a direct entry OTP othwise they won't even bother wasting time on such .

Check this one from mocacinno: https://bitcointalk.org/index.php?topic=5590142.msg67033305#msg67033305
This one specifically , is one of perfect example of what they can use that phone number for, a scam attempt using a well planned social engineering approach. On a normal day a lot people will fall for such scam with no doubt.