Crypto news

Analyzing the events of recent days, I have identified several critical attack vectors that require immediate attention from the crypto community. From large-scale phishing to software supply chain attacks, threats are becoming increasingly sophisticated and targeted.

"Operation Asterix": Nearly a Million Investors at Risk

I have discovered a large-scale phishing campaign in which attackers obtained a database containing approximately 885,000 phone numbers of crypto investors worldwide. The attack scheme included phone calls impersonating technical support and fake emails mimicking newsletters from major platforms such as Crypto.com. The ultimate goal is to trick the victim into visiting a phishing site or installing a malicious app that visually replicates the interfaces of popular wallets like Ledger, Trezor, or Exodus, in order to steal seed phrases.

Particularly alarming is the automation of the process: hackers used scripts to mass-cross-reference stolen numbers against the databases of major exchanges. The effectiveness proved high — in the German sample alone, the match rate was 13.6%, which allowed identifying 43,066 real investors. More than 5,500 confirmed Binance accounts were queued for attack. The largest data fragment contains numbers of German citizens (316,002), with residents of the US, UK, Hong Kong, and Ledger clients also appearing on the lists.

Fake AML Services: A New Trap for Wallet Owners

A new scheme for stealing funds through fake AML checkers has been recorded. Scammers copy the design of legitimate platforms like AMLBot or create neutral brands, offering to check a wallet for "cleanliness." The main trick is requesting a wallet connection for "scanning." After connecting, the site simulates analysis, showing fake loading indicators, and always returns a positive result. However, under the guise of paying a fee, the user is presented with a transaction that grants a malicious smart contract the right to withdraw all funds.

Supply Chain Attack on the Rust Ecosystem

A critical vulnerability has been identified in the popular Rust package arrayref (over 245 million downloads), which is used in blockchain tools for Ethereum and Solana. Attackers compromised the developer's account and injected malicious code that executes during compilation. The malicious dependency proc-macro1 was disguised as a legitimate package, while a fake build.rs script downloaded a trojan adapted to the victim's OS. Its task is to steal passwords from browsers and collect system information. There are signs linking this campaign to the North Korean group Sapphire Sleet, indicating a state-level threat.

Operation CameraSwarm: 14,500 Hacked Dahua Cameras

During a 35-day campaign, hackers compromised 14,530 Dahua surveillance cameras. The attack was carried out via three vectors: brute-forcing passwords on port 37777, exploiting five-year-old vulnerabilities through the p2pwn tool, and intercepting control via serial numbers. Owners are strongly advised to check devices for a hidden p2pwn account, disable the P2P feature, and update the firmware.

Manic Trojan: A Mesh Network for Data Theft

The new Android trojan Manic attacks more than 169 applications, including banking and cryptocurrency ones. Its uniqueness lies in its backup data transmission mechanism: if the smartphone is offline, the virus transmits stolen information to nearby infected devices via Wi-Fi Direct or Bluetooth, creating a mesh network of four nodes. Manic intercepts keystrokes, notifications, and can provide hackers with remote access to the screen.

My analysis: This week demonstrates attackers consolidating efforts around automation and the use of AI. The attack on the Rust ecosystem is particularly dangerous, as it affects fundamental development tools. I recommend that all developers and users audit dependencies and immediately update software. Attention to detail and avoiding unofficial sources are the only reliable defenses amid the growing complexity of attacks.