AI-Generated Phishing Apps Scour 885,000 Phone Numbers for Crypto Wallets

A sophisticated phishing operation, dubbed Operation ASTERIX, has been uncovered by Rapid7 Labs. The campaign leveraged AI coding assistants to create fake Ledger, Trezor, and Exodus apps that targeted self-custodied cryptocurrency users.

The researchers discovered a misconfigured server exposing the entire playbook of the operation. This included phone-number datasets, account-validation tools, phishing panels, voice-dialing scripts, and code to siphon stolen data out through Telegram.

The fake apps mimicked legitimate wallet software, asking users to enter their recovery phrases, which are essentially master keys to their funds. Whoever possesses these phrases can empty the wallets.

Rapid7 found that AI coding assistants were used across the entire development process, including packaging the Electron apps and obfuscating code. The tool employed was GitHub Copilot.