Operation ASTERIX: AI-Powered Crypto Fraud Campaign Exposed
Researchers at Rapid7 uncovered Operation ASTERIX, a sophisticated cryptocurrency fraud campaign that combined account enumeration, branded phishing, vishing (voice phishing), and trojanized wallet software to steal victims’ recovery phrases. The operation, named after the Asterisk telephony platform found in its infrastructure, employed a multi-stage social-engineering pipeline to target users with precision.
How the Attack Worked
-
Target Validation & Enrichment
- The threat actor compiled 885,000 phone numbers from datasets linked to Germany, Hong Kong, Bulgaria, the UK, the US, Canada, Ledger users, and fintech services.
- A Go-based checker validated 43,066 Crypto.com accounts from a German dataset of 316,002 numbers, achieving a 13.6% hit rate.
- The attacker used residential proxies, retry logic, and lead databases to identify high-value targets those likely to own crypto wallets or exchange accounts.
-
Multi-Channel Phishing & Vishing
- Victims received branded phishing emails impersonating platforms like Crypto.com and Binance, followed by automated voice calls (using Asterisk, 3CX, and custom scripts) citing personal details, support cases, and verification codes.
- The callers referenced real verification codes sent via email, creating a false sense of legitimacy.
- Victims were tricked into installing fake wallet updates or submitting recovery phrases under the guise of security checks.
-
Trojanized Wallet Software
- The campaign distributed counterfeit versions of Trezor Suite, Ledger Live, and Exodus for macOS and Windows.
- The fake Trezor Suite (packaged in Electron) killed the legitimate app, displayed a convincing replica, and prompted victims for 12-, 18-, 20-, or 24-word recovery phrases.
- Stolen data including recovery phrases, passphrases, and IP addresses was exfiltrated to a Telegram bot.
- The Ledger Live variant included clipboard hijacking, replacing copied crypto addresses with attacker-controlled ones.
- The Exodus installer used a trojanized JavaScript component to fetch malicious payloads post-installation.
-
AI Integration in Malware Development
- The exposed server revealed LLM session logs, shell history, and source code, showing the attacker used GitHub Copilot and Claude Code for:
- Managing lead lists
- Configuring validation scripts
- Troubleshooting network issues
- Packaging Electron apps
- When models refused to assist with obfuscation or payload hosting, the operator switched to Kimi AI and attempted jailbreak prompts to bypass safeguards.
- This marks one of the first documented cases of AI being actively integrated into a criminal malware-development pipeline.
- The exposed server revealed LLM session logs, shell history, and source code, showing the attacker used GitHub Copilot and Claude Code for:
Infrastructure & Persistence
- The attacker’s server hosted multiple ports for different functions:
- Port 8000: Fake wallet archives
- Port 8080: Installers and LaunchAgent files
- Port 5000: Password-protected Flask panels
- Port 9000: Installation telemetry
- Port 8090: Auxiliary control
- On macOS, persistence was achieved via LaunchAgents (
com.trezormovement.agent,io.trezor.agent), ensuring the malware relaunched at login.
Impact & Response
- Rapid7 observed 20 successful lead lookups and six phishing emails over two weeks, indicating a targeted, operator-led campaign rather than mass phishing.
- The company notified affected providers and authorities, including Apple’s security team, while parts of the infrastructure remained active.
- Indicators of compromise (IOCs) including Telegram bot tokens, LaunchAgent labels, and malicious file hashes were published on Rapid7’s GitHub.
Operation ASTERIX highlights the growing sophistication of crypto fraud, blending AI-driven development, multi-channel social engineering, and trojanized software to maximize success rates.
Source: https://gbhackers.com/operation-asterix-uses-vishing/
Exodus TPRM report: https://www.rankiteo.com/company/exodus-io
Crypto.com TPRM report: https://www.rankiteo.com/company/cryptocom
"id": "cryexo1787041502",
"linkid": "cryptocom, exodus-io",
"type": "Cyber Attack",
"date": "8/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': '43,066 validated accounts',
'industry': 'FinTech',
'location': 'Global',
'name': 'Crypto.com',
'type': 'Cryptocurrency Exchange'},
{'industry': 'FinTech',
'location': 'Global',
'name': 'Binance',
'type': 'Cryptocurrency Exchange'},
{'industry': 'FinTech',
'location': 'Global',
'name': 'Trezor',
'type': 'Crypto Wallet Provider'},
{'industry': 'FinTech',
'location': 'Global',
'name': 'Ledger',
'type': 'Crypto Wallet Provider'},
{'industry': 'FinTech',
'location': 'Global',
'name': 'Exodus',
'type': 'Crypto Wallet Provider'}],
'attack_vector': ['Phishing Emails',
'Voice Calls (Vishing)',
'Trojanized Wallet Software',
'Social Engineering'],
'data_breach': {'data_exfiltration': 'Yes (to Telegram bot)',
'number_of_records_exposed': '43,066 validated accounts '
'(potentially more)',
'personally_identifiable_information': 'Recovery phrases, '
'passphrases, IP '
'addresses',
'sensitivity_of_data': 'High (direct access to crypto '
'wallets)',
'type_of_data_compromised': ['Recovery phrases',
'Passphrases',
'IP addresses',
'Crypto wallet credentials']},
'description': 'Researchers at Rapid7 uncovered Operation ASTERIX, a '
'sophisticated cryptocurrency fraud campaign that combined '
'account enumeration, branded phishing, vishing (voice '
'phishing), and trojanized wallet software to steal victims’ '
'recovery phrases. The operation employed a multi-stage '
'social-engineering pipeline to target users with precision, '
'integrating AI-driven development for malware creation.',
'impact': {'brand_reputation_impact': 'Potential reputational damage to '
'Crypto.com, Binance, Trezor, Ledger, '
'and Exodus due to impersonation',
'data_compromised': 'Recovery phrases, passphrases, IP addresses, '
'crypto wallet credentials',
'identity_theft_risk': 'High (recovery phrases and passphrases '
'stolen)',
'operational_impact': 'Installation of trojanized wallet software, '
'clipboard hijacking, unauthorized access to '
'crypto wallets',
'payment_information_risk': 'High (crypto wallet credentials and '
'clipboard hijacking for crypto '
'address replacement)',
'systems_affected': ['macOS', 'Windows']},
'initial_access_broker': {'backdoors_established': 'Trojanized wallet '
'software (Trezor Suite, '
'Ledger Live, Exodus)',
'entry_point': 'Validated crypto exchange accounts '
'(Crypto.com)',
'high_value_targets': 'Users with crypto wallets or '
'exchange accounts'},
'investigation_status': 'Ongoing (parts of the infrastructure remained active '
'at disclosure)',
'lessons_learned': 'The integration of AI in malware development highlights '
'the evolving sophistication of cybercriminals. '
'Multi-channel social engineering (phishing + vishing) '
'increases success rates. Trojanized software can bypass '
'traditional security measures.',
'motivation': 'Financial Gain',
'post_incident_analysis': {'corrective_actions': ['Enhanced user education on '
'phishing/vishing',
'Improved detection of '
'trojanized software',
'Stronger authentication '
'mechanisms for wallet '
'access',
'Collaboration with '
'security researchers for '
'early detection'],
'root_causes': ['Lack of user awareness of '
'phishing/vishing tactics',
'Use of AI for malware development '
'and social engineering',
'Distribution of trojanized '
'software via fake updates',
'Clipboard hijacking for crypto '
'address replacement']},
'recommendations': ['Implement multi-factor authentication (MFA) for crypto '
'wallet access',
'Educate users on recognizing phishing and vishing '
'attempts',
'Monitor for unauthorized changes to wallet software',
'Use hardware wallets for high-value crypto assets',
'Deploy endpoint detection and response (EDR) solutions '
'to detect trojanized software',
'Regularly audit installed applications for legitimacy'],
'references': [{'source': 'Rapid7',
'url': 'https://github.com/rapid7/... (IOCs)'}],
'response': {'communication_strategy': 'Public disclosure of IOCs, advisories '
'to affected platforms',
'containment_measures': 'Notification to affected providers '
'(e.g., Apple’s security team), '
'publication of IOCs',
'remediation_measures': 'Removal of trojanized software, '
'revocation of compromised credentials',
'third_party_assistance': 'Rapid7 (research and disclosure)'},
'stakeholder_advisories': 'Affected platforms (Crypto.com, Binance, Trezor, '
'Ledger, Exodus) notified; Apple’s security team '
'engaged',
'title': 'Operation ASTERIX: AI-Powered Crypto Fraud Campaign',
'type': 'Cryptocurrency Fraud, Phishing, Vishing, Malware Distribution'}