Operation ASTERIX, a cryptocurrency fraud campaign that combined account enumeration, branded phishing, targeted voice calls, and trojanized wallet software to capture victims’ recovery phrases.
The campaign’s exposed operational server also revealed an unusually detailed view of how the operator incorporated AI coding tools into active fraud development.
Named after the Asterisk telephony platform found on the threat actor’s infrastructure, Operation ASTERIX was built as a staged social-engineering pipeline.
Rather than broadly targeting random users, the operator first validated whether phone numbers were linked to cryptocurrency services, then enriched successful matches with identifying and account-related information before launching phishing and vishing lures access.
Rapid7 found approximately 885,000 phone numbers across datasets associated with Germany, Hong Kong, Bulgaria, the UK, the US, Canada, Ledger-related lists, and fintech services.
A Go-based checker targeting a Crypto.com passkey-verification endpoint reportedly validated 43,066 accounts from a German dataset containing 316,002 numbers a 13.6% hit rate.
The actor used concurrent requests, residential proxies, retry logic, and lead databases to isolate users more likely to own exchange accounts or crypto wallets.
A subsequent caller could cite the victim’s name, exchange association, alleged support case, and the same verification code sent by email.
This multi-channel design is significant. The email made an incoming support call appear expected. At the same time, the caller’s knowledge of its contents created the illusion of a legitimate, ongoing account-security process.
The target was then directed to install a supposed wallet-security update, perform an account check, or submit a wallet recovery phrase.
Asterisk, 3CX, and scripts such as autodialer.sh, power_dialer.sh, and telegram_dialer_bot.py supported call automation and campaign coordination.
Recovered panel activity suggested a relatively targeted, operator-led campaign rather than indiscriminate high-volume phishing: one panel logged 20 successful lead lookups and six phishing emails across roughly two weeks.
Rapid7 recovered fake Trezor Suite, Ledger Live, and Exodus applications for macOS and Windows.
The most mature sample, a counterfeit Trezor Suite application, was packaged in Electron and built for Intel macOS, Apple Silicon, and Windows from the same core payload.
Rapid7 Researchers said that, the operation used phishing panels to generate counterfeit support cases, branded emails, and verification codes impersonating cryptocurrency and financial platforms, including Crypto.com and Binance.
On macOS, the fake Trezor app operated covertly, launching a transparent 1×1 Electron window and polling for the legitimate Trezor Suite process.
When the victim opened the real application, the malware killed it, displayed its own convincing wallet window, and prompted the user for a 12-, 18-, 20-, or 24-word recovery phrase and optional passphrase.
It then showed a fake validation failure, encouraging a second and potentially cleaner entry.
The stolen words, passphrase, and victim IP address were sent to a Telegram bot.
The application then redirected the victim to the authentic Trezor site, a tactic intended to delay discovery. macOS persistence relied on LaunchAgents configured to execute at login and relaunch when terminated.
The Ledger Live sample added clipboard hijacking on Windows, silently replacing copied cryptocurrency addresses with attacker-controlled addresses.
The Exodus installer used a trojanized JavaScript component to retrieve its malicious payload after installation.
Port 8000 served counterfeit wallet archives, port 8080 hosted installers and LaunchAgent files, port 5000 ran password-protected Flask panels, port 9000 collected installation telemetry, and port 8090 supported auxiliary control.
The exposed server contained LLM session logs, shell history, source code, and project files showing the actor used GitHub Copilot and Claude Code to manage lead lists, configure validation scripts, troubleshoot network issues, package Electron applications, and process campaign data.
When a model refused assistance with obfuscation and payload-hosting tasks, the operator switched to Kimi and attempted to defeat safeguards with a custom jailbreak prompt.
That finding matters because it documents AI as an operational development layer within an active criminal workflow not merely as a source of isolated code snippets.
The operator attempted to use model switching and prompt manipulation to preserve a malware-development pipeline when safeguards interrupted it.
Rapid7 notified relevant providers and authorities, including Apple’s security team, while parts of the infrastructure remained active.
The company has also published indicators of compromise and the recovered jailbreak material through its GitHub resources.
| kraken_checker | 4bee9affff9fa718a2c94f02ebe6a75143d4d461d291c2df9b769920fc927bf8 |
| Bot token (desktop, active) | 8682890653:AAG9… (truncated) |
| Bot token (web kit) | 8673815706:AAEs… (truncated) |
| LaunchAgent labels | com.trezormovement.agent, io.trezor.agent |
| Install directory | ~/Library/Application Support/Trezor SuiteFake/ |
| Dropped artifacts | /tmp/trezor-suite-debug.log, /tmp/trezor-monitor.log, /tmp/trezor-payload.zip |
| Local listener (old build) | 127.0.0.1:54322 |
| Exfil header string | TREZOR SECRET PHRASE |
| Bundle id / version | com.electron.trezor-suite / 1.0.0 (legitimate Suite is 24.x) |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
[Live Webinar] Join Elastic & UnderDefense to learn how small security teams can unify AI visibility and agentic response into one operating model. -> Register Now
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…