Rapid7 exposed Operation ASTERIX, a large-scale phishing and wallet fraud campaign targeting 885,000 users with AI-generated malicious tools and counterfeit hardware wallet apps.
Security & Exploits ·
Rapid7 disclosed Operation ASTERIX, a fraud operation targeting cryptocurrency holders through fabricated wallet applications and social engineering. The campaign leveraged approximately 885,000 phone numbers alongside counterfeit versions of Trezor, Ledger, and Exodus wallets, along with phishing emails and voice-based manipulation to harvest recovery phrases. In a single German dataset, attackers extracted 43,066 accounts from Crypto.com using 316,002 phone numbers as entry points, then augmented those profiles with additional personal information to strengthen their impersonation of support staff.
The operation employed multiple AI systems to accelerate attack development and data processing. Attackers used GitHub Copilot and Claude Code to write malicious code, debug software, and construct phishing infrastructure. When Claude declined to assist with code obfuscation tasks, the operator pivoted to Kimi and attempted to circumvent its safeguards using a custom jailbreak, though confirmation of success remains unavailable.
The full scope of compromised users extends beyond the German dataset analyzed. Specifics around total recovery phrases stolen, geographic distribution of targets outside Germany, and the operational timeline of the campaign have not been disclosed.