Operation ASTERIX: AI-Powered Crypto Fraud Campaign Exposed Researchers at Rapid7 uncovered Operation ASTERIX, a sophisticated cryptocurrency fraud campaign that combined account enumeration, branded phishing, vishing (voice phishing), and trojanized wallet software to steal victims’ recovery phrases. The operation, named after the Asterisk telephony platform found in its infrastructure, employed a multi-stage social-engineering pipeline to target users with precision. ### How the Attack Worked 1. Target Validation & Enrichment - The threat actor compiled 885,000 phone numbers from datasets linked to Germany, Hong Kong, Bulgaria, the UK, the US, Canada, Ledger users, and fintech services. - A Go-based checker validated 43,066 Crypto.com accounts from a German dataset of 316,002 numbers, achieving a 13.6% hit rate. - The attacker used residential proxies, retry logic, and lead databases to identify high-value targets those likely to own crypto wallets or exchange accounts. 2. Multi-Channel Phishing & Vishing - Victims received branded phishing emails impersonating platforms like Crypto.com and Binance, followed by automated voice calls (using Asterisk, 3CX, and custom scripts) citing personal details, support cases, and verification codes. - The callers referenced real verification codes sent via email, creating a false sense of legitimacy. - Victims were tricked into installing fake wallet updates or submitting recovery phrases under the guise of security checks. 3. Trojanized Wallet Software - The campaign distributed counterfeit versions of Trezor Suite, Ledger Live, and Exodus for macOS and Windows. - The fake Trezor Suite (packaged in Electron) killed the legitimate app, displayed a convincing replica, and prompted victims for 12-, 18-, 20-, or 24-word recovery phrases. - Stolen data including recovery phrases, passphrases, and IP addresses was exfiltrated to a Telegram bot. - The Ledger Live variant included clipboard hijacking, replacing copied crypto addresses with attacker-controlled ones. - The Exodus installer used a trojanized JavaScript component to fetch malicious payloads post-installation. 4. AI Integration in Malware Development - The exposed server revealed LLM session logs, shell history, and source code, showing the attacker used GitHub Copilot and Claude Code for: - Managing lead lists - Configuring validation scripts - Troubleshooting network issues - Packaging Electron apps - When models refused to assist with obfuscation or payload hosting, the operator switched to Kimi AI and attempted jailbreak prompts to bypass safeguards. - This marks one of the first documented cases of AI being actively integrated into a criminal malware-development pipeline. ### Infrastructure & Persistence - The attacker’s server hosted multiple ports for different functions: - Port 8000: Fake wallet archives - Port 8080: Installers and LaunchAgent files - Port 5000: Password-protected Flask panels - Port 9000: Installation telemetry - Port 8090: Auxiliary control - On macOS, persistence was achieved via LaunchAgents (`com.trezormovement.agent`, `io.trezor.agent`), ensuring the malware relaunched at login. ### Impact & Response - Rapid7 observed 20 successful lead lookups and six phishing emails over two weeks, indicating a targeted, operator-led campaign rather than mass phishing. - The company notified affected providers and authorities, including Apple’s security team, while parts of the infrastructure remained active. - Indicators of compromise (IOCs) including Telegram bot tokens, LaunchAgent labels, and malicious file hashes were published on Rapid7’s GitHub. Operation ASTERIX highlights the growing sophistication of crypto fraud, blending AI-driven development, multi-channel social engineering, and trojanized software to maximize success rates.

New Storm Infostealer Emerges as a Stealthy Threat to Browser and Crypto Security Security researchers at Varonis have identified Storm, a sophisticated infostealer malware that harvests browser credentials, session cookies, and cryptocurrency wallets before exfiltrating encrypted data to attacker-controlled servers. First observed on underground cybercrime forums in early 2026, Storm represents an evolution in credential theft tactics, bypassing traditional detection methods. Unlike earlier infostealers that decrypted data locally making them vulnerable to endpoint security tools Storm avoids detection by transmitting encrypted files to remote infrastructure for decryption. This approach circumvents protections like Google’s App-Bound Encryption (introduced in Chrome 127 in July 2024), which previously forced attackers to rely on detectable methods such as Chrome injection or debugging protocol abuse. Storm targets both Chromium-based (Chrome, Edge) and Gecko-based browsers (Firefox, Waterfox, Pale Moon), extracting saved passwords, session cookies, autofill data, Google account tokens, credit card details, and browsing history. It also captures system information, screenshots, and session data from messaging apps like Telegram, Signal, and Discord, while targeting crypto wallets via browser extensions and desktop applications. All operations run in memory to minimize forensic traces. A key feature of Storm is its automation: rather than requiring manual replay of stolen logs, it uses Google Refresh Tokens and geographically matched SOCKS5 proxies to silently restore authenticated sessions, granting attackers access to SaaS platforms, internal tools, and cloud environments without triggering password-based alerts. Available for under $1,000 per month, Storm has already compromised victims across multiple countries, including Brazil, Ecuador, India, Indonesia, the U.S., and Vietnam. Varonis identified 1,715 entries in attacker panels, though some may include test data. The stolen credentials span high-value platforms such as Google, Facebook, Twitter/X, Coinbase, Binance, and Crypto.com data commonly sold on credential marketplaces for account takeovers, fraud, and further cyber intrusions.

Crypto.com suffered a data breach executed by the Scattered Spider hacking group, led by teenage cybercriminals including Noah Urban (18, Florida), who specialized in SIM-swapping and social engineering. The attack exposed personal information of users, though the company claimed only a 'very small number of individuals' were affected and no customer funds were stolen. However, Crypto.com never publicly disclosed the breach to impacted users, raising transparency concerns. The incident was uncovered by a Bloomberg investigation and blockchain investigator ZachXBT, who accused the company of a cover-up. Despite the breach, Crypto.com reported $1.5B in revenue and $1B in gross profit (2023), with CEO Kris Marszalek pushing for an IPO and partnerships (e.g., Trump Media). The attackers, originating from Minecraft gaming communities, exploited telecom employee deception to hijack phone numbers, escalating into high-profile cybercrime targeting MGM Resorts and other corporations.