A phishing campaign impersonating COLDCARD demonstrates how quickly attackers can weaponise public concern surrounding a genuine security incident. Rather than exploiting the hardware wallet directly, the campaign uses fears about a recently disclosed COLDCARD vulnerability and suspected large-scale Bitcoin theft to convince users to install remote-access software on their Windows computers. Victims are told that COLDCARD is conducting a coordinated security audit across its hardware devices and that their participation is required to confirm the integrity of their wallets. 

The campaign is particularly effective because it appears shortly after reports that approximately 1,367 Bitcoin, worth an estimated $88.6 million, may have been stolen from thousands of addresses associated with a random-number-generation weakness affecting several COLDCARD models and firmware versions. Users who have seen these reports may already be concerned about the safety of their funds and therefore more willing to respond to an urgent message claiming to provide official verification. The attackers are not creating fear from nothing; they are attaching themselves to a real security event and presenting their malware as the solution.

The phishing emails are sent from an address using the domain `coldcardteamnews.com` and carry a subject such as “Hardware audit now available.” The message claims that recent findings require COLDCARD to verify devices across all hardware revisions and directs recipients to a supposed “Security Verification & Incident Reporting Tool.” To appear trustworthy, the email states that the process is air-gapped and will not request the user’s recovery seed. It also imposes a completion deadline, creating pressure to act before the recipient has time to verify whether the request is genuine.

The promise that the audit will not request the recovery seed is a particularly effective social-engineering technique. Cryptocurrency users are frequently warned never to disclose their seed phrase, and many have learned to treat any direct request for it as fraudulent. By explicitly stating that the seed will not be requested, the attackers anticipate the user’s main security concern and remove one of the most obvious indicators of a wallet scam. The victim may conclude that the process is safe because it follows one familiar security rule, even though it is asking them to download and execute an unverified program with administrator privileges.

Clicking the link takes the victim to `coldcardcompliance.com`, a counterfeit website designed to resemble an official COLDCARD service. The site presents a “Start Hardware Audit” button and includes a live customer-support chat feature. This interactive support channel makes the operation more convincing because users can ask questions and receive immediate answers rather than interacting with a static phishing page. Proofpoint believes the conversations are likely handled by real operators, allowing the attackers to adapt their instructions according to the victim’s operating system, technical knowledge and level of hesitation.

When a victim asks for assistance, the operator first determines whether the user is running Windows or macOS. Windows users are instructed to download and launch the audit tool. If the victim reports seeing a black command window or a User Account Control prompt, the operator explains that these are expected parts of the diagnostic process and tells the user to approve the request. This human interaction helps the attackers overcome precisely the moments when a cautious user might otherwise stop. A warning that should create suspicion is reframed by the operator as proof that the legitimate audit is progressing correctly.

The file downloaded from the fake website is named `Coldcard_Diagnostic_Tool.bat` and is hosted through a GitHub account. Using GitHub provides another layer of apparent legitimacy because users and security tools commonly permit access to the platform. The batch file is unusually large because it contains two Base64-encoded files embedded directly inside it. Keeping the files inside the script reduces the need to download multiple visibly suspicious payloads from attacker-controlled infrastructure and allows the complete installation package to arrive through one apparently simple diagnostic tool.

When executed, the script first displays behaviour resembling a legitimate hardware check. In the background, however, it determines whether it is running with administrator privileges. If the user has not already elevated the process, the script uses PowerShell to relaunch itself and display a User Account Control prompt. Once the user approves the prompt, the malware obtains the permissions required to install persistent remote-management software and make system-level changes.

The script then creates a randomly named directory within the Windows temporary folder and decodes the embedded Base64 content using `certutil`, a legitimate Windows certificate utility. The decoded files are saved as `setup.msi` and `docusign.exe`. The use of built-in tools such as PowerShell and `certutil` helps the attackers avoid introducing a separate decoder or installer utility. Each command may resemble ordinary administrative activity when viewed individually, but the complete sequence reveals a malicious installation chain.

The `docusign.exe` file is a legitimate, digitally signed executable that installs a DocuSign printer driver. It functions as a decoy by creating visible installation activity that appears consistent with the promised diagnostic process. Users may see an apparently genuine software component and assume that the audit has completed successfully. The presence of a valid digital signature on the decoy also provides false reassurance, even though the signed application is not the component providing attackers with access.

The `setup.msi` package is the actual malicious element. It installs ConnectWise ScreenConnect, a legitimate remote monitoring and management product widely used by IT support teams and managed service providers. Once installed, the ScreenConnect agent communicates with the attacker-controlled server at `activeretirementrelocation[.]com`, allowing the operators to access the system remotely. The batch script then displays an “Installation Complete” message and deletes the temporary installation directory, leaving the user believing that the COLDCARD audit has finished successfully.

The abuse of ScreenConnect demonstrates why legitimate remote-management tools are increasingly attractive to cybercriminals. These products are designed to provide reliable remote desktop access, command execution, file transfer and persistent connectivity across system restarts. Attackers do not need to build a custom backdoor when a professional administration platform already provides every capability required to control the victim’s computer. Because ScreenConnect has legitimate uses and may be digitally signed, its presence may also attract less attention from conventional antivirus tools than an unfamiliar malware family.

Once connected through ScreenConnect, the attacker may be able to view the desktop, browse files, execute commands, install additional malware and monitor the victim’s activity. In the context of a cryptocurrency hardware-wallet phishing attack, remote access creates several possible routes to financial theft. The attackers may search for wallet backups, transaction files, extended public keys, exchange credentials, browser sessions and notes containing recovery information. They may also wait for the user to connect or unlock the COLDCARD device and attempt to manipulate a transaction or observe sensitive information displayed on the computer.

A hardware wallet is designed to keep private keys isolated from an internet-connected computer, but it does not make the surrounding computer irrelevant. Users often prepare transactions, manage wallet software, review addresses and interact with exchanges on the same endpoint. Malware controlling that endpoint may attempt to replace destination addresses, alter transaction details, display misleading information or steal information used in wallet recovery. The hardware wallet can protect the private key only when the user carefully verifies transaction details on the trusted device itself.

The attack may also extend beyond cryptocurrency theft. ScreenConnect provides general access to the operating system, allowing attackers to steal business documents, email sessions, passwords and cloud credentials. Proofpoint warns that the remote access could be used to deploy additional malware or ransomware. A victim targeted because of interest in COLDCARD may also use the same computer for professional work, giving the attackers access to corporate networks and sensitive organizational information.

Organizations should maintain an inventory of approved remote-management tools and their authorised server addresses. The presence of ScreenConnect should not automatically be considered legitimate merely because the software is commercially available. Security teams need to determine who installed the agent, which management server it contacts and whether that instance belongs to the organization or an approved provider. A ScreenConnect service communicating with an unfamiliar external domain should generate immediate investigation.

Application-control policies can reduce the risk by preventing users from installing remote-management tools outside approved deployment mechanisms. ScreenConnect, AnyDesk, TeamViewer and similar products should be permitted only when there is a documented business requirement. Ordinary users should not be able to install persistent remote-access agents simply by approving a User Account Control prompt from an email-driven workflow. Restricting local administrator rights can make the attack more difficult, although attackers may still pressure users who possess approved elevation mechanisms.

Endpoint monitoring should focus on the full behaviour chain rather than any single file name. Useful indicators include a batch file launching PowerShell for elevation, `certutil` decoding Base64 content into a temporary directory, installation of an MSI package and creation of a new ScreenConnect service. Security products should also alert when remote-management software appears immediately after a browser visit to an unfamiliar compliance or wallet-related domain.

The use of GitHub for payload delivery illustrates why trusted platforms cannot be allowed automatically. Development and support environments may need legitimate GitHub access, but security systems should still inspect the file type, originating webpage and subsequent execution. A large batch file downloaded after visiting a newly registered cryptocurrency compliance domain should be treated differently from source code retrieved by an approved development tool.

Cryptocurrency users should verify security notices through official channels rather than links contained in unsolicited email. A genuine vendor advisory should be available through the official website, verified social-media accounts or the device’s documented support process. Users should type the known vendor address manually or use an existing bookmark instead of following links claiming that urgent action is required.

COLDCARD users should also understand that a hardware security audit should not require installing an unfamiliar Windows batch file or granting remote administrative access to the computer. Hardware wallets are specifically intended to reduce dependence on the security of an internet-connected endpoint. Any process that claims to audit a hardware wallet by installing persistent remote-control software fundamentally contradicts that security model.

Users should never provide remote access to anyone claiming to be wallet support. Legitimate support teams do not need unrestricted control of the customer’s computer to verify wallet integrity. They should also never share a recovery seed, PIN, passphrase, private key or wallet backup, regardless of whether the request is made through email, chat, telephone or remote desktop. The fact that this campaign initially promises not to request the seed does not mean the attacker will not search for it after obtaining system access.

Any user who executed the fake diagnostic tool should disconnect the computer from the network immediately and treat the system as compromised. Simply closing the ScreenConnect window or deleting the downloaded batch file is not sufficient because the remote-access agent may continue running as a Windows service. The system should be examined for ScreenConnect installations, unexpected services, PowerShell activity, temporary files and communication with the attacker’s server.

Where remote access was successfully established, rebuilding the computer from a trusted operating-system image is safer than attempting limited removal. Attackers may have installed additional malware, created accounts or modified security settings after connecting. Passwords, exchange credentials and cloud sessions accessible from the affected computer should be changed from a clean device, and active sessions should be revoked. Changing passwords while the attacker still controls the original computer may simply expose the replacements.

Users should review cryptocurrency transactions and wallet activity carefully. If the recovery phrase, passphrase or wallet backup may have been accessible on the compromised computer, funds should be transferred to a newly created wallet using a new recovery seed generated on a trusted hardware device. Reusing the existing seed on a clean computer does not remove the risk if the attacker has already copied it.

Even when the seed was never stored digitally, users should verify that no unauthorised transactions occurred and should review whether exchange accounts or browser-based wallet services were exposed. Hardware-wallet owners sometimes focus so heavily on the physical device that they overlook the security of exchange accounts, email addresses and transaction-management software surrounding it.

The campaign also reinforces why breach communications require careful planning. When a genuine vulnerability becomes public, customers are likely to receive follow-up messages claiming to offer audits, patches, refunds or recovery assistance. Vendors should warn customers proactively that attackers may impersonate their support teams and should clearly explain the only approved update and verification procedures.

Security announcements should state whether users need to install firmware, regenerate wallet seeds, migrate funds or take no action. Ambiguity creates an opportunity for attackers to offer a simpler and more urgent solution. Official communications should also list the domains and email addresses customers can trust while making clear that support staff will never request recovery phrases or remote computer access.

Email-security systems should block newly registered domains impersonating wallet and cryptocurrency brands. However, domain blocking alone is insufficient because attackers can register new names quickly. Detection should also examine sender authentication, message urgency, audit-themed language, external download links and the delivery of executable scripts. A message claiming to be from COLDCARD but originating from an unrelated news or compliance domain should not be treated as legitimate.

The broader lesson is that attackers routinely exploit the response to a security incident as aggressively as they exploit the original vulnerability. Public disclosure creates a population of anxious users who expect instructions, updates and support. Criminals use that period of uncertainty to impersonate the vendor and present malware as remediation.

The campaign does not need to defeat the COLDCARD hardware security architecture directly. It persuades the user to install a legitimate remote-management platform on the surrounding computer and then gives the attacker control over everything the user does there. This approach is often easier than attacking the hardware wallet itself because it targets human trust and endpoint administration rather than cryptographic protections.

Organizations and individuals should therefore evaluate every security notice independently, especially when it arrives shortly after a widely reported breach or vulnerability. A message can contain accurate references to a real incident and still be fraudulent. In fact, the accuracy of those details is often what makes the deception successful.

A genuine security audit should reduce access and strengthen trust. The fake COLDCARD audit does the opposite: it requests administrator privileges, installs persistent remote-control software and connects the system to infrastructure controlled by an unknown operator. That contradiction is the clearest warning sign. When an alleged wallet-security process requires surrendering control of the computer, the audit is not examining the victim’s security. It is removing it.

A phishing campaign is exploiting fears surrounding the recently disclosed COLDCARD wallet vulnerability and suspected $88.6 million Bitcoin theft to trick users into installing ScreenConnect remote access software. [...]

Source: COLDCARD security audit phishing attack installs remote access tool via Bleeping Computer — published 05 Aug 2026.