Crypto Scammer Uses Claude Code to Process 100,000+ Phone Numbers for Victim Targeting

A cryptocurrency fraud operation has been found using AI coding tools to turn huge phone lists into a sharper victim-targeting system.

The campaign combined account checks, phishing emails, phone calls, and counterfeit wallet software to pursue people likely to own digital assets.

The operation, tracked as Operation ASTERIX, exposed an unusually complete view of a scammer’s workspace.

Its server held raw contact lists, lead databases, email panels, calling tools, and fake applications.

Analysts at Rapid7 identified the activity after finding an exposed web directory used by the operators.

Rapid7 said in a report shared with Cyber Security News (CSN) that the evidence suggests a targeted operation in which each channel reinforced the next, making an apparent support request seem credible.

The impact goes beyond one stolen-wallet lure. By validating account ownership before outreach, the actor could avoid random cold calls and concentrate effort on people with a likely exchange or hardware-wallet connection.

Crypto Scammer Uses Claude Code

The server contained about 885,000 phone numbers from several regions, including a file with 316,002 German mobile numbers. It also held lists tied to Hong Kong, Bulgaria, the UK, the US, and Canadian financial services.

The operator used account-checking tools to test whether numbers belonged to cryptocurrency-platform users.

In one German dataset, the tooling confirmed 43,066 accounts, roughly 13.6 percent of the 316,002 numbers checked.

Those matches became richer profiles with names, email addresses, locations, and account details. Claude Code played a practical role in that workflow.

Recovered session logs show the operator asking it to clean and format a file of more than 100,000 Polish phone numbers, add country prefixes, and manage checking scripts connected to proxy pools.

The exposed materials showed AI being used throughout development, rather than only to create isolated code.

The wider pattern mirrors fake Claude Code installer attacks, where convincing documentation pages turn routine software searches into a route for malicious downloads.

The researchers also found that the actor used AI assistants for packaging Electron applications, modifying phishing infrastructure, troubleshooting builds, and attempting code obfuscation.

When Claude resisted help with parts of the wallet-malware workflow, the operator moved to another provider and submitted a custom jailbreak prompt designed to weaken safety controls.

Phishing calls amplify wallet theft

After creating enriched leads, the actor used branded email panels to generate bogus support cases and verification codes.

A follow-up call could cite the same details, giving the caller a persuasive way to impersonate support staff.

This technique follows the familiar pattern of phone calls delivering malware but applies it to cryptocurrency theft.

The calling environment included Asterisk and scripts for outbound dialing. Investigators did not recover enough call logs to rebuild every interaction, but one panel recorded 20 successful lead lookups and six phishing emails over about two weeks.

That points to deliberate targeting rather than indiscriminate mass calling. Victims were directed to counterfeit applications styled as Trezor Suite, Ledger Live, or Exodus.

The fake Trezor program waited for the genuine application to open, terminated it, and showed a lookalike recovery-phrase screen.

It asked for a 12-, 18-, 20-, or 24-word phrase and could send the result, passphrase, and victim IP address to Telegram.

A separate fake Claude Code site offered a trojanized installer that deployed a hidden Ledger Live lookalike before launching the legitimate Claude installer.

Such layered deception resembles malicious Claude Code ads, which rely on trusted-looking setup instructions to get users to run attacker-supplied commands.

Users should treat unexpected support emails, verification codes, and follow-up calls as related warning signs, not independent proof of legitimacy.

Wallet providers and exchanges do not need a recovery phrase to secure an account.

Download applications only from a verified official source, confirm a caller through an independently obtained contact channel, and never paste a terminal command supplied by an ad or unfamiliar webpage.

These precautions also help against counterfeit wallet delivery schemes, where a polished interface conceals credential theft.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world