Operation ASTERIX Anatomy of a Crypto Fraud Pipeline

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://rapid7.com/blog/post/tr-operation-asterix-crypto-fraud-vishing-phishing
• Blog Title: Operation ASTERIX: Anatomy of a Crypto Fraud Pipeline
• Suggested Section: Phishing Methodology / Electron Desktop Apps, with cross-references to macOS Auto Start and Clipboard Hijacking

🎯 Content Summary

Operation overview

Operation ASTERIX was an active cryptocurrency-fraud pipeline that combined bulk account enumeration, enriched victim records, branded phishing, Asterisk/3CX vishing, counterfeit Electron wallet applications, recovery-phrase theft, clipboard hijacking, macOS persistence, Telegram exfiltration, and AI-assisted malware development. Rapid7 reconstructed the operation after discovering an unauthenticated directory listing on the attackers' infrastructure. The exposed fi...

🔧 Technical Details

Account-existence API enumeration: If an authentication, passkey, recovery, or registration endpoint returns distinguishable results for registered and unregistered identifiers, attackers can use it as an account oracle. Bulk POST requests can validate phone numbers or email addresses with concurrent workers, retry logic, and rotating proxies. Positive matches can then be enriched and prioritized for targeted fraud. Defenses include uniform responses, strict per-identity and per-network throttling, behavioral detection, bot mitigation, and step-up verification.

Cross-channel trust construction: A phishing email can create a fake support case, verification code, or incident number that is later referenced by a caller with access to enriched victim data. The email makes the call expected, and the caller's knowledge makes the email appear legitimate. This technique can be reused whenever attackers control multiple communication channels and can s...

🤖 Agent Actions

Updated:

src/generic-methodologies-and-resources/phishing-methodology/README.md

Added:

• Account-existence oracle targeting
• Cross-channel email/vishing trust construction
• Launch-triggered Electron process replacement
• Recovery-phrase quality control
• Renderer-to-main IPC analysis guidance
• Detection correlations
• Links to existing Electron, macOS persistence, and clipboard-hijacking pages
• Numbered Rapid7 reference with inline citations

Validation passed: clean diff, sequential references, valid internal links, no forbidden sources. mdbook was unavailable, so a full build was not run.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://rapid7.com/blog/post/tr-operation-asterix-crypto-fraud-vishing-phishing

Content Categories: Based on the analysis, this content was categorized under "Phishing Methodology / Electron Desktop Apps, with cross-references to macOS Auto Start and Clipboard Hijacking".

Repository Maintenance:

• MD Files Formatting: 989 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0