Rapid7 uncovers crypto phishing operation using AI-assisted development

Rapid7 has documented a cryptocurrency phishing operation, tracked as Operation ASTERIX, that used AI coding assistants to develop fake wallet apps and automate vishing calls. The campaign targeted users of Trezor, Ledger, and Exodus, and involved validating phone numbers against crypto exchange accounts to focus social engineering on confirmed holders.

The exposed server contained roughly 885,000 phone numbers, with the largest dataset of 316,002 German mobile numbers yielding 43,066 confirmed Crypto.com accounts. The operator used Asterisk and 3CX for automated calls, and phishing panels generated fake support emails.

Rapid7 notified relevant authorities, including Apple’s security team, and the infrastructure was still active during the investigation.