Operation ASTERIX Uses Vishing and Fake Crypto Wallet Apps to Steal Seed Phrases

Gbhackers •Mayura Kathir • August 18, 2026

Operation ASTERIX, a cryptocurrency fraud campaign that combined account enumeration, branded phishing, targeted voice calls, and trojanized wallet software to capture victims’ recovery phrases. The campaign’s exposed operational server also revealed an unusually detailed view of how the operator incorporated AI coding tools into active fraud development. Named after the Asterisk telephony platform found on […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Operation ASTERIX: AI-Driven Crypto Fraud Campaign Exposed Operation ASTERIX is a sophisticated cryptocurrency fraud campaign that utilized vishing, phishing, and fake wallet applications to steal recovery phrases from victims. Rapid7 researchers discovered an exposed server containing tools for account enumeration, phishing panels, and AI-assisted development artifacts. The campaign targeted confirmed cryptocurrency users by verifying phone numbers linked to active accounts. Key components included counterfeit Ledger, Trezor, and Exodus applications, as well as Telegram exfiltration code. The operation's infrastructure was still active at the time of discovery, allowing for timely notifications to relevant authorities. The use of AI coding assistants was notable, with operators attempting to bypass safety controls to enhance their fraud tools. This multi-faceted approach highlights the increasing sophistication of cybercriminal operations in the cryptocurrency space. 10 sources 68

Extracted Entities

Operation ASTERIX Uses Vishing and Fake Crypto Wallet Apps to Steal Seed Phrases

The full story

Extracted Entities

Attack Types (2)

Campaigns (1)

MITRE ATT&CK (2)