COLDCARD security audit phishing attack installs remote access tool

A Phishing Campaign Exploits COLDCARD Fears

A phishing campaign is exploiting fears surrounding the recently disclosed COLDCARD wallet vulnerability and suspected $88.6 million Bitcoin theft to trick users into installing ScreenConnect remote access software. The campaign uses emails impersonating COLDCARD that claim a security audit is underway across its hardware cold storage wallet devices.

The emails are sent from compliance@coldcardteamnews.com with the subject "Hardware audit now available" and tell recipients that recent findings require COLDCARD to verify the integrity of devices across all hardware revisions. The emails direct users to an alleged "Security Verification & Incident Reporting Tool," claiming the process is air-gapped, will not request their recovery seed, and must be completed by August 10.

Clicking an "Access the Audit Tool" button opens the site coldcardcompliance.com, which impersonates COLDCARD with a message to click on the "Start Hardware Audit" button to download the tool. The fake website also includes a live "Customer Service" chat feature that allegedly allows targets to receive support for their COLDCARD devices.

In chats shared by Proofpoint, an operator asks whether the victim uses Windows or macOS and then instructs Windows users to run the downloaded tool. When one user reported seeing a black window and an administrator prompt, the operator explained that the prompt was required to begin the installation and told them to click "Yes."

Proofpoint believes these conversations are likely being handled by real people rather than an automated chatbot, allowing the attackers to respond to concerns and pressure hesitant victims into proceeding with the installation.

The Attack Unfolds

Batch file installs remote access software

Proofpoint shared on X that clicking on the website's "Start Hardware Audit" button downloads a batch file named Coldcard_Diagnostic_Tool.bat from a GitHub account. BleepingComputer analyzed the 25.7MB batch file shared by Proofpoint and found that it contains two Base64-encoded files embedded directly in the file.

When launched, the script first pretends to perform a diagnostic check on your device, but in the background it actually checks whether the user has administrator privileges. If it does not, it uses PowerShell to relaunch itself with a User Account Control prompt to request elevated permissions.

The script then stores the embedded Base64-encoded files in a randomly named directory as setup.msi [VirusTotal] and docusign.exe [VirusTotal] in the Windows temp folder and decodes them using Windows certutil.

After installing the setup.msi file, the script launches docusign.exe, displays an "Installation Complete" message, and then deletes the temporary directory.

The docusign.exe file is a legitimate signed executable that installs a DocuSign printer driver, which acts as a decoy during the attack.

The MSI launched setup.msi file is actually a ConnectWise ScreenConnect installer, which is a remote management tool that gives the threat actor remote access to the device.

When launched, Proofpoint says it connects to the activeretirementrelocation[.]com, which is the ScreenConnect command-and-control server used by the threat actor.

Once connected through ScreenConnect, the attackers could remotely access the computer, steal data or cryptocurrency, or install additional malware.

Proofpoint warns that this access could also be used to deploy ransomware.

Test Every Layer Before Attackers Do

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Get the whitepaper