Operation ASTERIX: Anatomy of a Crypto Fraud Pipeline
Rapid7 exposed infrastructure behind a cryptocurrency fraud pipeline using phishing panels, voice-dialing scripts, fake wallets, and AI coding assistants.
Rapid7 researchers identified an exposed web directory on infrastructure used to support a cryptocurrency fraud operation tracked as Operation ASTERIX. The server contained raw phone-number datasets, account-validation tools, enriched lead records, phishing panels, voice-dialing scripts, fake wallet applications, persistence mechanisms, and Telegram exfiltration code. Recovered prompts, shell history, and project files show the operator relied on AI coding assistants to package Electron applications, obfuscate code, troubleshoot builds, and modify phishing infrastructure.
- Exposed directory revealed the full tooling stack of a crypto fraud operation.
- Fake wallet apps built with Electron and exfiltration via Telegram.
- Operator used AI coding assistants for app packaging, obfuscation, and infrastructure changes.
- Campaign combines vishing, phishing panels, and lead enrichment for social engineering.
- Tags
- ai-coding-assistantscryptocurrency-fraudelectronfake-wallet-appsoperation-asterixphishingtelegramvishing
- Vendors
- Rapid7
- Threat actors
- Operation ASTERIX
- Organizations
- Rapid7
From the original article
Operation ASTERIX overview Rapid7 researchers identified an exposed web directory on infrastructure used to support a cryptocurrency fraud operation. The server contained raw phone-number datasets, account-validation tools, enriched lead records, phishing panels, voice-dialing scripts, fake wallet applications, persistence mechanisms, and Telegram exfiltration code.
By Anna Širokova · rapid7.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.