Operation ASTERIX: How a Fake Support Call Delivers a Counterfeit Wallet App

If someone calls you, knows your name and your email address and asks you to reinstall a wallet application, then the call is in all likelihood the attack itself. That is exactly the pattern the security firm Rapid7 describes in a report dated August 17, 2026, under the name Operation ASTERIX. The core of it for readers in Germany sits in a single figure: the largest file secured held 316,002 German mobile numbers. The case is notable because it wires together three attack routes that usually appear separately. A phone system dials automatically. An email supplies the pretext. And at the end sits a program that looks like the familiar wallet software and asks for the recovery words. Once you have understood this chain, you can spot it at the point where it breaks. Operation ASTERIX Explained: What Rapid7 Found on an Open Server Operation ASTERIX is the name for a fraud chain that combines phone calls, phishing emails and counterfeit wallet programs into a single sequence. The analysts assigned the name themselves: the server was running Asterisk, an open-source phone system, and that formed the backbone of the calls. The server was found because its operators made a mistake. Accord...