Operation ASTERIX: AI-assisted crypto phishing targeting wallet recovery phrases
Rapid7 uncovered Operation ASTERIX, an AI-assisted cryptocurrency fraud campaign that combined phishing emails, voice calls, and counterfeit wallet applications to target crypto users' recovery phrases. The exposed infrastructure contained approximately 885,000 phone numbers and evidence that attackers used GitHub Copilot to develop malicious tools, though the operation was in early stages when discovered.
What happened
Rapid7 discovered Operation ASTERIX, a cryptocurrency fraud campaign that used a misconfigured web server to coordinate mass account enumeration, phishing emails, voice calls and counterfeit wallet applications to steal users' recovery phrases. The exposed server contained approximately 885,000 phone numbers organized by geography, including 316,002 German mobile numbers, and automated tools to identify which numbers were connected to cryptocurrency services.
The attacker used a Go-based tool to query Crypto.com's account-existence endpoint with rotating residential proxies, confirming 43,066 accounts from the German dataset. Validated accounts were enriched with names, email addresses and locations before being targeted with branded phishing emails impersonating Crypto.com and Binance, coordinated with fraudulent support calls using Asterisk, an open-source telephony platform.
Victims were directed toward counterfeit versions of Ledger Live and Trezor Suite wallet applications, which prompted users to enter their recovery phrases for exfiltration via Telegram. The attacker used GitHub Copilot to write and refine malicious code, including attempts to bypass security safeguards built into the AI assistant.
Reported impact
Activity logs recovered from the server showed only 20 lead lookups and 6 phishing emails sent over an approximately two-week period, indicating the operation was in early stages when discovered. One recovered Binance lead panel displayed 5,576 validated crypto targets queued for attack, though no reports of successful theft were disclosed.
Index analysis
The attack chain combined social engineering across multiple communication channels—email, voice calls, and fake applications—to create psychological reinforcement and increase success rates. The attacker's use of AI coding assistants to build malicious tools demonstrates integration of large language models into sophisticated fraud infrastructure.
Governance controls
Rapid7 coordinated disclosure with Apple Security and relevant authorities after discovering the exposed infrastructure. Much of the infrastructure remained active or under development when discovered, allowing notification to service providers before widespread attacks occurred.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.