A large-scale phishing operation against 885,000 crypto investors, an attack on the Rust ecosystem, and other threats of the week
Analyzing the cyber threat landscape over the past seven days, I have identified several alarming trends that require close attention from every market participant. From large-scale phishing campaigns to attacks on software supply chains, attackers are demonstrating increasingly sophisticated methods.
Operation "Asterix": Nearly a Million Investors Under Attack
The most resonant event was a phishing campaign in which hackers obtained a database of 885,000 phone numbers of crypto investors worldwide. The attackers operated using a classic but finely honed scheme: they called victims posing as technical support or sent phishing emails disguised as popular services, including Crypto.com.
Of particular danger is the use of automated scripts to cross-check numbers against the databases of major exchanges. The effectiveness of this method is impressive: in a sample from Germany, the match rate was 13.6%, which allowed identifying 43,066 real investors. More than 5,500 confirmed Binance accounts made it onto the priority attack list. Notably, hackers actively used artificial intelligence tools to generate phishing content, making the attacks more personalized and convincing.
Fake AML Services: A New Trap for Wallet Owners
Attackers are creating fake platforms for checking wallets for "cleanliness," copying the design of legitimate services like AMLBot. The scheme is simple: the site requests a wallet connection for "scanning," then simulates the analysis process and issues a false positive result. The entire essence of the attack lies in the user signing a malicious transaction disguised as a fee payment, which grants the smart contract access to funds. Scammers use the same website template, only changing the logos.
Attack on the Rust Ecosystem: A Threat to Blockchain Development
The compromise of a developer account for the popular arrayref package led to the infection of a library with over 245 million downloads. The malicious code executed during project compilation, making it extremely dangerous for blockchain tools, including components for Ethereum and Solana. The trojan, injected via the proc-macro1 dependency, collected system information and stole passwords from browsers. Experts note the similarity of this attack's infrastructure to the actions of the North Korean group Sapphire Sleet, indicating state sponsorship.
Dahua Camera Hack: 14,500 Devices Under Control
Hackers compromised 14,530 Dahua surveillance cameras over 35 days using three different attack vectors. The most widespread was password guessing against an open port. They also exploited five-year-old vulnerabilities and intercepted control via serial numbers. I strongly recommend device owners check the control panel for a hidden p2pwn account, disable the P2P function, and update the firmware.
Manic Trojan: Data Theft via Neighboring Smartphones
The new Android trojan Manic targets 169 applications, including banking and cryptocurrency ones. Its unique feature is the ability to transmit stolen data through other infected devices via Wi-Fi Direct or Bluetooth if the victim's smartphone is offline. This creates a resilient mesh network for data leakage, significantly complicating its interception and blocking.
My analysis: This week demonstrates a consolidation of attackers' efforts around two key areas: social engineering using AI and attacks on software supply chains. Investors should exercise maximum vigilance with any incoming requests to connect wallets, and developers should thoroughly check their project dependencies. The market is entering a phase where cyber hygiene is becoming not just a recommendation but a critical factor for capital survival.