Rapid7's Operation ASTERIX Analysis Shows AI Integration into Cryptophishing

Artificial intelligence and cryptophishing have officially become inseparable concepts in the cybercrime sphere following the publication of a massive analytical report by the authoritative company Rapid7. In a global investigation codenamed Operation ASTERIX, experts uncovered an unprecedented level of advanced neural network integration into traditional schemes aimed at deceiving digital asset holders. Criminals have fully automated data verification processes, which allowed them to elevate the effectiveness of targeted attacks to a fundamentally new, frightening level.

The uncovered cybercriminal infrastructure was based on the utilization of a gigantic array of confidential information, including approximately 885,000 unique telephone numbers. Instead of chaotic bulk message broadcasts, the attackers applied complex artificial intelligence algorithms to pinpoint exactly which contacts were linked to active accounts on major trading platforms. The identified matches were immediately enriched with detailed personal records of the victims, including their names, current email addresses, and geolocation data.

Based on these structured databases, operators of the malicious campaign deployed a multichannel pipeline combining phishing emails, automated voice calls (vishing), and high-tech fake applications for hardware wallets. The scammers created counterfeit software clients for popular interfaces such as Trezor, Ledger, and Exodus, with the primary goal of covertly stealing mnemonic recovery phrases (seed phrases). The presence of AI assistants helped the attackers continuously generate unique conversation scripts and even bypass the ethical safety filters of language models.

Global Operation ASTERIX and New Data Compromise Methods

The key feature of the discovered threat was not so much the sheer volume of collected contacts, but rather the exquisite precision of the pre-filtering process applied to potential victims by the scammers. Researchers from Rapid7 obtained a German dataset, which clearly illustrated the economic efficiency of the new AI strategy. Out of 316,002 mobile numbers belonging to German citizens, an automated script managed to instantly identify 43,066 confirmed accounts on the popular Crypto.com exchange.

Such a high percentage of exact matches, amounting to more than 13.6% of the total database volume, completely justifies any financial expenses incurred by hackers to maintain the server infrastructure. Once artificial intelligence confirmed the link between a phone number and a specific exchange, operators enriched the victim's profile with data from open sources and past leaks. As a result, when scammers made a vishing call on behalf of technical support, they already knew the client's name, email, and the exact platform where their savings were stored.

In parallel, a separate database prepared specifically for clients of the industry leader, the Binance trading platform, was discovered on the Operation ASTERIX servers. The control panel contained 5,576 fully validated and enriched crypto-investor profiles, which were queued for sending customized phishing emails. The synergy between text messages and subsequent phone calls created an illusion of total legitimacy for the victim, forcing people to download fake software for macOS and Windows.

The use of neural networks was also recorded at the stage of writing malicious software code, where the attackers tried to automate the creation of phishing pages. When one of the basic language models began blocking dangerous requests due to built-in safety constraints, the operator instantly switched to alternative artificial intelligence providers. Researchers recorded the use of special jailbreak prompts with XML tags, which were designed to manipulate the reasoning logic of the neural network to obtain prohibited content.

Crypto Market Analysis and Current Asset Prices on the Binance Exchange

Despite the emergence of information about such sophisticated hacker attacks aimed at users of the largest ecosystems, general market sentiments remain moderately optimistic. Traders demonstrate high resilience to the negative information background, and trading volumes on spot platforms continue to hold stably high indicators. Today, market participants are more focused on macroeconomic indicators and the local price movement of the main coins.

Key Event: The publication of the Rapid7 report coincided with a noticeable increase in volatility in the upper echelon of cryptocurrencies, forcing exchanges to strengthen security measures and issue phishing warnings. The largest players urge users to thoroughly check domain addresses when downloading wallet updates and under no circumstances enter their private keys on third-party web resources.

If we study the current price situation directly on the Binance trading platform, right now, today, the quotes demonstrate a local upward impulse at the current moment in time. The cost of the main digital coin Bitcoin in the BTC/USDT pair at the current moment has fixed in the area of $71,253 — $71,691 per coin, demonstrating a daily increase of more than 9%. At the same time, the second largest coin by capitalization, Ethereum, holds positions near important levels, which confirms the general stability demonstrated by the global digital asset ecosystem under the changing landscape of cyber threats, pushing developers to implement robust crypto security protocols.

“Data database leaks and their automatic verification through neural networks are the main challenge for investor security this year. Scammers no longer need to guess whether you have cryptocurrency. They call knowing your balance, your name, and what hardware wallet you use. In such conditions, trust in incoming calls should be zero, and the only reliable storage remains a cold wallet with a securely hidden seed phrase,” security specialists comment on the situation on social networks.

Against the backdrop of increasingly sophisticated hacker attacks, long-term investors are more frequently abandoning the storage of large amounts of funds on exchange custodial accounts, preferring decentralized methods. The growing popularity of non-custodial systems stimulates the development of infrastructure where safety depends exclusively on the user themselves. At the same time, many continue to use decentralized networks and explore how the underlying advanced blockchain architecture can prevent such data manipulation, considering validation as the most transparent way to accumulate assets protected from human factor vulnerabilities.

Methods of Protection Against Intelligent Phishing and Expert Recommendations

The scale of Operation ASTERIX clearly demonstrated that traditional methods of assessing the authenticity of emails and calls no longer work in the era of generative artificial intelligence. Due to deep data enrichment, attackers are capable of creating personalized scenarios that are practically impossible to distinguish from official notifications from the support service of financial institutions.

Key Event: A joint operation by Rapid7 and Apple's security service allowed for the prompt blocking of part of the command and control servers of the malicious campaign, preventing the mass distribution of fake applications for macOS. Nevertheless, experts warn that clones of this infrastructure could be launched by other hacker groups in the shortest possible time due to the availability of commercial AI tools.

To minimize the risks of crypto savings theft, specialists strongly recommend completely eliminating the practice of clicking on links from incoming SMS messages or emails related to account verification. Any actions to update software for Ledger or Trezor hardware wallets must be performed exclusively through official built-in application managers downloaded from original sources. Checking incoming information through independent communication channels is becoming a basic survival rule in the modern digital space.

Benefits for Readers from the Rao Cash Editorial Team

The analytical team of the financial editorial office of Rao Cash has prepared a summary of the most important rules of personal cybersecurity for its regular readers, compiled based on the results of the Operation ASTERIX analysis:

• Immediate Call Drop Rule. If you receive a call from the "support" of an exchange or wallet and they call you by name, hang up and call back yourself through the official website.


• Absolute Taboo on Key Transfer. No employee of Ledger, Trezor, or Binance will ever, under any circumstances, request your seed phrase of 12 or 24 words.


• Rejection of Third-Party Updates. Never download wallet update files from links in emails; use only the official software installed previously.


• Implementation of Hardware 2FA Keys. Switch from two-factor authentication via SMS to secure applications (Google Authenticator) or physical YubiKey keys.

The introduction of artificial intelligence into the toolkit of cybercriminals requires maximum concentration and total skepticism toward all incoming information from every investor. The fact that the caller knows your personal data is no longer proof of their affiliation with an official organization. Rao Cash experts will continue to monitor the development of the situation in the field of crypto security around the clock to promptly provide you with the most relevant capital protection methods.