Crypto-phishing campaign targeting 885,000 phone numbers uncovered!

[AmoreJaz]

I often get calls from scammers, but I never answer them. Some calls are automatically rejected by my device using its security system and some calls I reject manually. Since the security system is enabled on the device, the numbers are marked as spam calls and keep warning me. I still don't know what will happen if I receive the calls!

But I am so careful that if someone ever asks for something secret like a seed or OTP, I should not hesitate to mark it as a scam. Since I never receive the calls, I am not too worried yet. The numbers are also relatively easy to identify, I almost always get calls from numbers that start with +1 and the number pattern is also the same. It is best to ignore such calls and emails as much as possible, especially before clicking on the link.

In today's age, everyone should really be aware of these scammers and as much as possible be conscious of what you are pressing or answering. These fraudsters are just waiting for their next victim. As that is their job, they will keep lurking in the net.

[terrific]

At this point, all ones(specially who have cryptos) should assume that their phone numbers are in the list of scammers and watch out every unknown call. Unfortunately, the attach surfaces got wider and wider with AI tools.

Exactly.
All of those KYCs and other forms that we've filled up are probably already in the bad guys' hands.
That's why if we can dispose those numbers, update and change it.
Because they'll continue to come and I kept on receiving scam texts and the same goes with the emails that we own.

[Churchillvv]

This is more than a reminder, it’s now a warning number xxx. The highest data anyone needs to find you is email and phone number having been used in several services, you’re then vulnerable to whatever attack they may come up with. For this it’s a well known scam method but usually spread across where there is less awareness, since Germany has less awareness on this so this guys just spread mails across and if it finds someone vulnerable then they can fest on that person.

When some of these centralised platforms suffer from a data breach, they wouldn't inform the victims. Whenever users' data is stolen, it is kept secret to protect the name or reputation of such an organisation. This secrecy causes people to be prone to scams since they are not aware that their data has been collected by scammers.

I’ve never thought of it this way but, of course you’re right and then the times where they finally announce such events is based on the fact that some people are already compromised and have fallen victim of the scam, maybe sharing this with the company for further damages to be prevented they announce it to the public that data’s have been stolen.

[Alphakilo]

Many of these tricks have existed for a very long time, very few scams are sophisticated attacks.

Actually, this method of first sending a message or an email and then calling the victim to confirm the code is new in the market, and this is being used by scammers worldwide because just a few days back, I saw a post on Facebook where a person was saying that a friend of his got scammed using the same method, but a little bit different. The scammer first sent a message with the code, then called the victim through a number that is generally used by that company, and the scammer said the code and asked for confirmation, the guy told him the OTP, but then the caller said it expired and a new one will be sent and he should tell him, the victim did it because by that time he thought it's actually support.
There is no doubt that scammers are getting smarter day by day.

Not really, thiis one specifically  is common, I'm surprised  there're still some people who aren't aware of the famous scam method and this thing is  global . It's usually a password reset OTP or a direct entry OTP othwise they won't even bother wasting time on such .

Check this one from mocacinno: https://bitcointalk.org/index.php?topic=5590142.msg67033305#msg67033305
This one specifically , is one of perfect example of what they can use that phone number for, a scam attempt using a well planned social engineering approach. On a normal day a lot people will fall for such scam with no doubt.

Most times I wonder if Bitcoin investors should be continuously educated on how to avoid scams instead of focusing more on being hacked or facing wrench attacks.
Scammers could be really convincing but anyone with much knowledge of their theatrics can easily identify them and avoid them by any means necessary.
Also phishing links can be avoided too, that's why it's good to be tech savvy before going into Bitcoin investment and try to stay updated on our devices, exchange apps and always be vigilant because evil never rest.


 

[X-ray]

btw dont follow any links or instructions if you are contacted unsolicited by someone claiming to be from Ledger, Trezor, Binance, Kraken, or Crypto.com support regarding a security issue.
and never share your seed phrase with a support representative!

The default response people should do when getting called by someone claiming from these companies should be ignoring it, even better if you ignore any calls relating to your crypto wallet.

Those are scams and in any case if you have problem with the hardware wallet or the exchanges' service, you should be the one reaching out not them.

The fact that the phishing campaign targets so many phone numbers and very structured means they are making huge amount of money scamming people and there are many that has fallen into the scheme.

On another note, I think those company should also have a big banner on their website saying they will never call their customers or ask for seed phrase, a small warning banner is not enough.

[pawanjain]

Scammers are way too advanced these days. I came across a similar story on social media recently.
A scammer portrays himself as bank person and first sends a message to the victim with an OTP and then calls the victim and tells him the OTP.
Somehow the victim gets convinced since the scammer tells him the OTP and ends up getting scammed.
It's crazy to see how far scammers can go with their frauds and scam innocent people of their life savings.
Stay vigilant and staying aware has now become a necessity.

OTP scams are quite common, but this very one does not entirely portray how it works, at least from what I already know.
Afaik, scammers don't actually send the OTP. What they do is, they try to access a particular service that is being used by their victims with the available data they already have_{(phone number or something else)}. Then that particular service sends the OTP to the actual user of that service_{(the victim)} because it's actually a security measure for anyone who's trying to gain access. Then the scammer makes the call to the victim, and pretends to work for that particular service. But in a case where the scammer already has the OTP, I don't see the point of contacting the victim unless there's more to the story.

The thing is, the scammer actually portrays himself from that particular service and to gain the victim's confidence they also confirm the OTP sent to them.
Thus the victim gets convinced knowing that they are talking to an authorized person and that is exactly when the scammer starts the actual scam.
The initial strategy is to gain the victim's confidence then trap him and scam them for their money.

[retreat]

As someone who frequently receives calls and messages from unknown and unverified numbers, I know my phone number is already in a scammer’s database. When I first received a suspicious message like that, I immediately unlinked that phone number from all the platforms I use, but I still keep the number because I’ve had it for a very long time. As for the numbers I use for exchange accounts and the like, I use a postpaid number that I don’t use very often and that has an anti-spam feature.

So we just need to be careful when receiving messages or calls from unknown numbers. Scammers these days are so sophisticated that they can even mimic people we know using deepfakes.

[Faisal2202]

You’re right, coldcard incident has nothing to do with this attack but if you read the follow up sentence you would understand why i mentioned it. I was insinuating if the coldcard recent incident could influence people to fall for further phishing attacks after the attackers have their numbers.

My bad if I failed to understand what you were insinuating haha. Your statement reminded me of someone from my community who was also insinuating a lot of things and then said what I did wrong. Anyway, I am not saying you did anything wrong. It's just maybe I failed to understand what you just insinuated. So please, next time you say something, try to make it more clear if that's possible, although you can write in any way. It's you and you can do what you want. It was just my 2 cents!

Haha, by the way, can you tell me if the hackers even had the numbers of the wallet owners? Just because the addresses are known to the hacker of the Coldcard wallet?

[Zoomic]

This is to tell us that the more we expose their patterns, the more they device new means of achieving their unholy aim.

The old phishing messages with mistakes that were obvious for observant crypto users to easily spot became obsolete so they decided to add phone call afterwards which will make it more convincing.

They know that it'll be easier for people to stop not question them much and provide the details they need when they're convinced that they're talking to customer support.

That's we should be vigilant and treat any "support" that contacts us first as a suspect. Always verify through the official channels yourself before clicking or sharing any information.

[ArabBTC]

Hmmmm, it is really alarming how this scammers seems to be improving by the day, they are now using phone numbers of which they will further trace the persons email and possibly send links to be requiring for their informations, every crypto investor has to be extremely careful this period because of the high rate of crypto fraud, don’t fall prey into the hands of this scammers who are bent on using any strategy just to scam anyone that will be careless with informations regarding their seed phrase etc, it will be very painful that ones investment over the years is swindled by this scammers because of carelessness on anyone’s part.

[Z-tight]

The old phishing messages with mistakes that were obvious for observant crypto users to easily spot became obsolete so they decided to add phone call afterwards which will make it more convincing.

There is nothing new about this, scammers have always used the method of calling people or sending them SMS, to attempt to scam them. It didn't even start with crypto, in the past, and less common now, scammers also used this means to steal fiat from people.

If you are familiar with crypto atm scams that's been going on for years now, you'd know how common this method is. Scammers call potential victims and trick them into depositing cash in a crypto kiosk and send it to them, lol.

[BALIK]

researchers at Rapid7 apparently stumbled upon a crypto scam campaign that was still active at the time of discovery due to a mistake made by the scammers!
there were approximately 885,000 phone numbers on the server. the largest share (316,002 phone numbers) came from germany. of these, 43,066 (about 13.6%) could apparently be linked to a crypto account.

I read the report and saw that scammers didn't just do mass phishing. They first validated phone number and isolated likely crypto users. Then they created trust with personalized email, phone call and fake Ledger/Trezor/Exodus app. Once someone enters their recovery phrase into fake wallet app, it's game over. Because whoever has the seed phrase, controls your wallet.

And AI has helped scale and refine the existing social-engineering pipeline here. So I think our defense should be simple too. Unsolicited support call/email mean suspicion. Never install wallet software without official source. And it's never a good idea to bring the seed phrase online. Biggest security feature of self-custody is ultimately our own verification discipline.

[Hamza2424]

Exactly.
All of those KYCs and other forms that we've filled up are probably already in the bad guys' hands.
That's why if we can dispose those numbers, update and change it.
Because they'll continue to come and I kept on receiving scam texts and the same goes with the emails that we own.

Forms are just one thing we did. Think of airdrops, most of us joined hundreds of them, if not tens, and then also gave our KYC details in order to increase the chances of our eligibility. They could have been run by the hackers, but it is fortunate that AI was not that advanced in those times. Otherwise, hackers would have still launched their fake ass projects to get our IDs.

Disposing numbers is not possible in many regions. Here, we can only have five numbers in total, and disposing them is possible, but if we are using our numbers in a way that it becomes a part of our life, it gets hard.

But yep, we should dispose of them if we start getting more. But there are tools on the internet that can find the associated numbers as well. Don't know how that works.

[PrivacyG]

Hmmmm, it is really alarming how this scammers seems to be improving by the day, they are now using phone numbers

Except they have been using phone numbers for scams about since mobile phones exist.

Really bad shit post by the way.

[Cricktor]

I don't answer unknown foreign country calls at all. I'm very hesitant to answer calls from unknown numbers and if I do, I say nothing at the beginning of the call (don't want to hand out my voice samples to a potentially malicious actor on the other side). I let the caller speak first.

And seriously, I wonder why people still fall for and install unverified wallet software that has been slipped under their noses. You NEVER install wallet software that doesn't come from official wallet provider's website or source links. You ALWAYS verify crypto checksums and/or signatures of wallet software, no exception whatsoever.

You NEVER disclose your mnemonic recovery words (and optional mnemonic passphrase if used) to any caller or any unverified software. You NEVER type your mnemonic recovery details into an online website or an unknown/untrusted device.

This is very basic wallet security and every crypto coin user should know about it.

[ImGenius]

Isn't it necessary to always hide seed phrase so that it can't be access easily even by me. Well no one can convince me to share my seed phrase, even if someone convince me to think they are real I may not share it because I have to find it and manually write it.
It is also true that not everyone is like me. There are some people who know nothing about Bitcoin they just store Bitcoin as digital gold and maybe no one tells them that the Bitcoin seed phrase should not be given to anyone. Scammers probably target these kinds of people the most because they don’t know much about this and can be convinced very easily.

[Porfirii]

At this point, all ones(specially who have cryptos) should assume that their phone numbers are in the list of scammers and watch out every unknown call. Unfortunately, the attach surfaces got wider and wider with AI tools.

Exactly.
All of those KYCs and other forms that we've filled up are probably already in the bad guys' hands.
That's why if we can dispose those numbers, update and change it.
Because they'll continue to come and I kept on receiving scam texts and the same goes with the emails that we own.

I don't know where you have filled up your KYC, but I don't think this is true in most cases. I agree with fwman that we all should assume that not only phone numbers like he said, but other personal data could've been leaked somewhere and be suspicious when in doubt. I personally don't answer phone calls from unknown numbers and delete before opening every SMS and email that I did not wait or have requested. Seeing how their attacks are progressing, these measures may not be enough at some point, but for the moment I would say that they are the minimum required.

[BlackHatCoiner]

The biggest red flag isn't even the fake email. It's the follow-up phone call. Since when does any crypto exchange actually have a customer support team that calls you? If Binance is ringing my phone proactively to "help" me, I already know it's 100% a scam.

If someone asks for your seed phrase, tell them to touch grass and get a real job.

[Sunshine1525]

Exactly.
All of those KYCs and other forms that we've filled up are probably already in the bad guys' hands.
That's why if we can dispose those numbers, update and change it.
Because they'll continue to come and I kept on receiving scam texts and the same goes with the emails that we own.

That's why you should avlud storing your coin in wallets that would require you to do KYC and expose your informations to the bad guys if your coin is saved in a multi sig wallet that's very secured, i doubt that you'll have any reason to worry when you get those texts but rather advice people on how to react when they recieve such.

On the other hand, we you received text from unverified source that request private stuffs like your seeds the best thing to do is to ignore such messages because they're scammers.

[Hatchy]

I’m also wondering if the recent coldcard incident has made further phishing easier to pull off. The coldcard incident has  made people concerned about security, so a message claiming their wallet needs an urgent update or security check is sounding much more believable. Regardless if users receive such messages it’s always safer to avoid such links or contact provided in the message, if such update exists then it should be on the official site or service where you can go and verify yourself

It's just another form of scamming people. Over the years many have been victims of this supposed scam attempt. We have always wondered how our data leaks out to these scammers but with time it becomes clear that they are stolen from the companies data bases and then carefully planned to see who would be so naive to fall victims of their traps. These kinds of scam can be easily recognised at least for someone who uses the internet regularly you must have come across alot of warnings especially from services that involves financial delivery that they will never call or message you request certain codes, passwords, or other financial information.

So, whenever you receive a call and the first thing you hear is, "We sent a code to you for this or that, please read it back to us," that should immediately raise a red flag. It is likely a targeted scam attempt, and you should never share the code with them. I don't know but it feels like since the cold card incident, indeed we've got many of these phishing attempts and data leaks. We should be careful where our data is being shared..