Operation ASTERIX Uses Vishing and Fake Wallet Apps in Crypto Fraud Pipeline

Aug 19, 2026 · Original article ↗

Summary

Rapid7 reconstructed Operation ASTERIX from an exposed server, uncovering crypto account enumeration, coordinated phishing and vishing, fake wallet apps, Telegram exfiltration and AI-assisted malware development.

Key points

An exposed web directory revealed source code, phone datasets, phishing panels, wallet malware and AI session logs, allowing Rapid7 to reconstruct the operation.
Account-checking tools processed roughly 885,000 phone numbers; recovered logs recorded 43,066 Crypto.com account matches in a German dataset of 316,002 numbers.
Branded phishing emails and Asterisk-based calls shared fake support-case details to build trust and steer targets toward counterfeit Trezor Suite, Ledger Live and Exodus applications.
The macOS Trezor impersonator monitored for the legitimate wallet, terminated it and displayed a counterfeit recovery form; collected phrases, passphrases and public IP addresses were sent to Telegram.
macOS builds used LaunchAgents for persistence. Configuration errors left the recovered Windows Trezor build functioning only as a static seed-phrase collector, without its intended persistence or process-replacement behavior.
A cloned Claude Code documentation page delivered an installer that installed a hidden fake Ledger Live application before running the legitimate Claude installer.
Recovered artifacts showed AI-assisted coding, packaging and troubleshooting. The operator switched providers after refusals and attempted a Kimi jailbreak, but Rapid7 could not confirm whether it succeeded.

Article Details

Attack Vectors: Account-validation scripts checked bulk phone-number datasets against cryptocurrency exchanges, then enriched confirmed matches for targeted social engineering.
Branded phishing emails generated fake support cases and verification codes that operators referenced during follow-up vishing calls.
Counterfeit wallet applications collected recovery phrases and optional passphrases while impersonating legitimate wallet software.
A cloned Claude Code documentation site substituted an installation command that deployed a fake Ledger Live application before installing legitimate Claude Code.
The fake Ledger Live Windows build replaced copied cryptocurrency addresses with attacker-controlled addresses.
A trojanized jquery.min.js in the Exodus build fetched a remote payload after installation.
Defensive Notes: The macOS samples used LaunchAgents, including com.trezormovement.agent.plist, io.trezor.agent.plist, and com.ledger.live.agent.plist, for persistence.
The fake Trezor application scanned for the legitimate wallet every five seconds, terminated it, and displayed a counterfeit recovery interface.
The recovered Windows Trezor build had an undefined platform configuration; its persistence, process-replacement, and second-stage execution paths were unreachable. It still functioned as a static recovery-phrase collector.
Rapid7 Labs reported disclosing the infrastructure and findings to relevant providers and authorities, including Apple’s security team.
Rapid7 stated that recovered indicators were ingested into Intelligence Hub to protect its customers.
Recovered evidence did not establish whether the attempted Kimi jailbreak succeeded.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`36mcrypto[.]com`	Campaign infrastructure domain also listed under beacon indicators.
DOMAIN	`ledger[.]com[.]lv`	Campaign domain identified as a phishing page.
DOMAIN	`ledgerhelp[.]com`	Campaign domain identified as a phishing page.
DOMAIN	`macos-claude[.]com`	Hosted cloned Claude Code documentation and a malicious installer delivering counterfeit Ledger Live.
DOMAIN	`ses-noreply[.]com`	Listed as email infrastructure associated with the phishing operation.
DOMAIN	`xcjnrucne9xfvmci[.]com`	Listed as a beacon domain in the operation's network indicators.
IPV4	`31[.]57[.]35[.]88`	Listed as infrastructure supporting the fraud operation.
IPV4	`82[.]25[.]35[.]200`	Listed as infrastructure supporting the fraud operation.
IPV4	`82[.]25[.]35[.]77`	Listed as infrastructure supporting the fraud operation.
SHA256	`0f2c7194f1f577e73460db9ec2e75fc0c7f845588cbd4246333b7a4fbec90d9f`	macOS x64 launcher associated with the counterfeit Trezor application.
SHA256	`4bee9affff9fa718a2c94f02ebe6a75143d4d461d291c2df9b769920fc927bf8`	Recovered kraken_checker artifact used in the operation's account-validation pipeline.
SHA256	`7073b2a3a34525c5969921dd17ef1fa5607af92be78b3fc6129cdea73216691a`	macOS arm64 launcher associated with the counterfeit Trezor application.
SHA256	`961a398a5c71e837626b5fce68e44b14a5d220e3bd74a3d0ecd61a2762c38176`	Counterfeit Trezor Suite.exe Windows executable.
SHA256	`ba9d459169a303067a4fe36c8b8582a5ea023b9c270dafe89613bab840501b19`	Shared malicious app.asar payload in all three counterfeit Trezor Suite builds.
URL	`hxxp[:]//136[.]0[.]213[.]184:1337/api/kraken-numio`	Endpoint explicitly identified as Kraken checker C2.