Operation ASTERIX Shows AI Refusals Are a Speed Bump, Not a Stop Sign

MakeCryippreferred on

• Rapid7 Labs found a crypto-phishing operation’s entire workspace exposed on a misconfigured server, including logs of Claude Code refusing a code-obfuscation request and the operator switching to a different model, Kimi, to get it done anyway.
• The same operation’s Windows build of its fake Trezor Suite app never worked, broken by a config file that only recognized macOS.
• The pipeline had already validated 43,066 accounts out of 316,002 German phone numbers before Rapid7 found it, a 13.6% hit rate.

When the operator behind a large crypto-phishing campaign asked Claude Code to obfuscate malicious code, Claude refused. The operator switched to Kimi, built by Moonshot AI, and got it done there instead, according to a technical report Rapid7 Labs published this week.

The refusal didn’t stop the operation. It just moved the work to a different model. But it wasn’t free, either: the same operator’s Windows build shipped broken, its theft code disabled by a leftover macOS-only config setting. Something slipped in the handoff between tools.

Guardrails Acted as Friction, Not a Wall

AI guardrails here acted less like a lock and more like friction, real, but nowhere close to enough to stop a determined operator on its own. Inside Anthropic’s own ecosystem, that friction has held up better: during a recent Ethereum/USDT contract audit, Claude Fable 5 fell back to the more restricted Opus 4.8 once the questions turned toward exploitability. Operation ASTERIX shows what happens once a user leaves that ecosystem instead of staying inside it: the operator didn’t wait around for a fallback model, it just went to a different company’s product. What actually shut the operation down wasn’t Claude’s refusal. It was Rapid7 stumbling onto an exposed, unauthenticated web directory that handed over the operator’s entire toolkit and logs.

This tracks a wider pattern, one Anthropic itself is trying to get ahead of. Anthropic disclosed last September that Claude Code carried out an estimated 80-90% of a state-linked espionage campaign autonomously before it was disrupted, and it has since backed Project Glasswing, a defensive push meant to find critical vulnerabilities before criminals do. A malware strain called OkoBot, documented since January, uses a similar trick to Operation ASTERIX’s fake wallet apps: hijacking Electron-based wallet software to show a fake recovery-phrase screen. Criminals building on commercial AI assistants, and routing around them the moment they refuse, isn’t new anymore.

The Jailbreak Still Carrying Claude’s Fingerprints

The jailbreak prompt sent to Kimi ran thousands of words, built around a fictional persona named “ENI” and a trigger phrase, “cold coffee, warm LO, I can’t lose him,” meant to override safety responses. It still contained Claude-specific system tags, carried over from whatever was used against Claude. Kimi is a different model from a different company. Pasting Claude’s own internal framing into it does nothing there. It reads as a copy-paste error, not a calibrated attack.

885,000 Phone Numbers, One Exposed Server

885,000 phone numbers across 54 countries sat on the exposed server. A Go script checked them against Crypto.com’s passkey endpoint using 300 threads and rotating residential proxies. Validated numbers fed a vishing operation on Asterisk and 3CX phone systems, source of the “ASTERIX” codename, and counterfeit Trezor, Ledger Live, and Exodus apps that sent stolen seed phrases to Telegram bots.

Rapid7 says it notified Apple’s security team and acted against the infrastructure while the operation was still active. No threat actor has been named, and no loss or victim figure has been made public. The open question isn’t whether AI models should refuse obfuscation requests. It’s whether a user jumping between models mid-task, especially while copy-pasting one company’s safety language into another’s product, is itself a signal worth watching for.