Rapid7 uncovered Operation ASTERIX, a cryptocurrency fraud campaign that used exposed infrastructure to stage phishing panels, vishing tools, fake wallet apps, and Telegram exfiltration while heavily relying on AI coding assistants during development. The operator also tried to bypass model safety controls with a custom jailbreak prompt after one AI model resisted parts of the workflow. #OperationASTERIX #TrezorSuite #LedgerLive #Exodus #Asterisk #Crypto.com #Kraken

At a glance Actor Unnamed crypto fraud operator (single host) Activity type Phishing, vishing, fake wallet malware, AI-assisted development Targets Cryptocurrency holders across 54 countries Scale About 885,000 phone numbers; thousands of validated accounts (claimed) Status Reported to authorities and Apple; no arrests announced Source Rapid7 Labs TL;DR Rapid7 Labs found an exposed server behind a crypto fraud operation it calls Operation ASTERIX.