Cybersecurity firm Rapid7 disclosed Operation ASTERIX, a cryptocurrency fraud campaign that used roughly 885,000 phone numbers, crypto account-validation tools, phishing emails, vishing calls, and counterfeit Trezor, Ledger, and Exodus wallet apps to target crypto users and steal recovery phrases. In one German dataset, the operators identified 43,066 CryptoCom accounts from 316,002 phone numbers, then enriched confirmed targets with personal details to make support impersonation more convincing.

Rapid7 also found that the operators used GitHub Copilot and Claude Code to process target data, develop and debug malicious software, and build phishing infrastructure. After Claude refused requests related to code obfuscation, the operator switched to Kimi and attempted to bypass its safety controls with a custom jailbreak prompt, though Rapid7 could not confirm whether the attempt succeeded.