Rapid7 Finds Crypto Phishing Ring That Used AI Chatbots to Build Its Own Malware

A misconfigured web server handed cybersecurity researchers a rare look inside a working crypto fraud operation, down to the AI chat logs the operator used to build it.

Rapid7 Labs discovered the exposed directory and published its findings on August 17, 2026, dubbing the campaign Operation ASTERIX after the open-source telephony software, Asterisk, found on the server. The operator used Asterisk to automate phone calls as part of a scheme that combined bulk account checking, phishing emails, voice calls, and counterfeit wallet apps to steal cryptocurrency recovery phrases.

How the targeting worked

The server held roughly 885,000 phone numbers pulled from datasets tied to Germany, Hong Kong, Bulgaria, the UK, the US, Canada, and Ledger-specific lists, according to Rapid7 and confirmed by GBHackers and CyberPress. The largest single file contained 316,002 German mobile numbers.

Rather than cold-calling at random, the operator ran those numbers through automated account-checking tools first. A Go-based script hit a Crypto.com passkey-verification endpoint using 300 concurrent threads, retry logic, and rotating residential proxies, according to GBHackers. Against the German dataset, it confirmed 43,066 active accounts, a 13.6% hit rate, meaning roughly one in seven numbers checked out.

CyberPress reported the operators also maintained a separate checker for Kraken and kept region-specific files for Ledger users split across 54 countries. Once a number was confirmed live, the operator enriched the record with names, emails, locations, and in some cases payment-card information, according to files recovered by Rapid7 labeled valids.txt and valid_leads.db.

The pitch

The enriched leads fed a two-pronged approach. Phishing panels impersonating Crypto.com and Binance generated fake support cases and verification codes and emailed them to targets. A caller would then follow up, citing the same case number and code from the email, according to Rapid7 and GBHackers.

That combination made the scheme work. The email made an unsolicited call seem expected. The caller's knowledge of specific account details made a scam sound like real customer support. Scripts named autodialer.sh, power_dialer.sh, and telegram_dialer_bot.py handled the automation, and the operation ran on both Asterisk and 3CX telephony platforms.

The endgame was a fake wallet app. Rapid7 recovered counterfeit versions of Trezor Suite, Ledger Live, and Exodus, built for Intel Macs, Apple Silicon, and Windows from a shared codebase. The most developed sample, a bogus Trezor Suite app, ran a nearly invisible background process on macOS that watched for the real Trezor Suite application, killed it when launched, and popped up its own convincing wallet window asking for a 12-to-24-word recovery phrase. Stolen phrases were exfiltrated via Telegram, according to Rapid7 and Security Arsenal.

AI in the malware supply chain

Rapid7 recovered shell history, prompts, and project files showing the use of AI coding assistants throughout development, not just to write isolated snippets.

CyberSecurityNews reported the operator used Claude Code specifically to clean and reformat a file of more than 100,000 Polish phone numbers, add country prefixes, and manage proxy-connected checking scripts. GitHub Copilot was used to help package the Electron-based fake wallet apps, obfuscate code, and troubleshoot builds, according to Rapid7 and the Crypto Briefing summary of its report.

When Claude began refusing to help with parts of the wallet-malware workflow, the operator switched to a different AI provider and wrote a custom jailbreak prompt to try to weaken that model's safety controls, Rapid7 said. One model's refusal did not stop the operation, it just added a short delay before the operator routed around it.

Security Arsenal's writeup notes that the malware itself is not exotic. Fake Electron wallet apps and Telegram-based exfiltration are established techniques. What is new is a mid-tier fraud operator building a full multi-channel pipeline, complete with working account-validation infrastructure and cross-platform malware, largely by leaning on AI assistants for the parts they could not code themselves.

Scale and current status

Despite the industrial-scale tooling, the actual operational tempo recovered from logs was narrow. One panel showed only 20 successful lead lookups and 6 phishing emails sent over roughly two weeks, according to Rapid7, GBHackers, and CyberPress. That suggests a hands-on, operator-led campaign rather than mass spam, though the underlying database of 885,000 numbers and a 13.6% exchange-account hit rate implies the operator had the capacity to identify more than 120,000 active crypto users if the checking tools were run at full scale.

Rapid7 said it disclosed the exposed infrastructure to relevant authorities and coordinated with Apple's security team while parts of the operation were still active, allowing for potential takedown or blocking action rather than after-the-fact documentation alone. No named individual or entity has been charged in connection with Operation ASTERIX in the material reviewed, and Rapid7's report does not identify the operator by name or nationality.

What remains unclear is whether the exposed server represents the operator's full infrastructure or one node among several, and whether the account-validation technique against Crypto.com's verification endpoint has been patched or throttled since Rapid7's disclosure.