Full Report
A phishing campaign is exploiting fears surrounding the recently disclosed COLDCARD wallet vulnerability and suspected $88.6 million Bitcoin theft to trick users into installing ScreenConnect remote access software. [...]
Analysis Summary
# Incident Report: COLDCARD Phishing & ScreenConnect Deployment
## Executive Summary
A targeted phishing campaign is exploiting a legitimate hardware wallet vulnerability and an $88.6 million Bitcoin theft to trick users into installing remote access software. Attackers masquerade as the COLDCARD support team, directing victims to a malicious "Hardware Audit" tool that installs ConnectWise ScreenConnect. The campaign utilizes social engineering via live chat and malicious batch scripts to gain full remote control over victim workstations, potentially to steal cryptocurrency or deploy ransomware.
## Incident Details
- **Discovery Date:** August 2026 (Reported by Proofpoint)
- **Incident Date:** August 2026
- **Affected Organization:** COLDCARD hardware wallet users
- **Sector:** Cryptocurrency / Individual Retail Investors
- **Geography:** Global
## Timeline of Events
### Initial Access
- **Date/Time:** August 2026
- **Vector:** Phishing Email
- **Details:** Emails sent from `compliance[@]coldcardteamnews.com` with the subject "Hardware audit now available." The email claims a security audit is mandatory due to recent vulnerabilities and directs users to a fake website (`coldcardcompliance[.]com`).
### Lateral Movement
- **Details:** While the initial stage focuses on workstation compromise, the installation of ScreenConnect provides a persistent "foothold" for the attacker to move laterally across a local network or access connected crypto-wallets and sensitive documents.
### Data Exfiltration/Impact
- **Details:** The primary goal is the compromise of the victim's machine to facilitate the theft of cryptocurrency or the installation of further malware, such as ransomware.
### Detection & Response
- **How it was discovered:** Identified by Proofpoint threat researchers.
- **Response actions taken:** Analysis of the malicious batch files and MSI installers; public disclosure of indicators to warn the cryptocurrency community.
## Attack Methodology
- **Initial Access:** Phishing emails leading to a spoofed website.
- **Persistence:** Installation of ConnectWise ScreenConnect (Remote Management Tool).
- **Privilege Escalation:** Malicious batch script uses PowerShell to relaunch itself with a UAC (User Account Control) prompt to gain administrator rights.
- **Defense Evasion:** Use of legitimate tools (Certutil) to decode Base64 payloads; use of a decoy executable (`docusign.exe`) to distract the user.
- **Credential Access:** Potential for keylogging or screen scraping via remote access.
- **Discovery:** System reconnaissance via the "Diagnostic Tool" interface.
- **Lateral Movement:** Capabilities provided by the ScreenConnect remote access software.
- **Collection:** Manual data theft by threat actors via remote session.
- **Exfiltration:** Standard outbound traffic via ScreenConnect.
- **Impact:** Remote control of the host; potential total loss of funds.
## Impact Assessment
- **Financial:** High risk of cryptocurrency theft; related to a previous $88.6 million loss incident.
- **Data Breach:** Full access to all files and communications on the compromised machine.
- **Operational:** System compromise requires full wipe and recovery.
- **Reputational:** Exploits the brand trust of Coinkite/COLDCARD.
## Indicators of Compromise
### Network Indicators
- `coldcardcompliance[.]com` (Phishing site)
- `compliance[@]coldcardteamnews[.]com` (Sender)
- `activeretirementrelocation[.]com` (ScreenConnect C2)
### File Indicators
- `Coldcard_Diagnostic_Tool.bat` (Initial payload)
- `setup.msi` (ScreenConnect installer)
- `docusign.exe` (Decoy printer driver)
- SHA256: `7ad243cd358d916e029ba8ff9a616dfdcab29b594a9ebf08a66a1c4bd63fb7e2` (setup.msi)
- SHA256: `5f0dc835d9e37318f862c64db85cc094059bb5404a1c1752facdfd16a784570a` (docusign.exe)
### Behavioral Indicators
- PowerShell scripts spawning UAC prompts.
- Use of `certutil.exe` to decode files in the `%TEMP%` directory.
- Unsolicited installation of ScreenConnect on a personal device.
## Response Actions
- **Containment:** Isolate infected machines from the internet immediately to kill the ScreenConnect session.
- **Eradication:** Delete temporary files and uninstall unauthorized remote management tools.
- **Recovery:** Recommended full OS reinstall for any machine that executed the batch file with admin privileges.
## Lessons Learned
- **Fear as a Trigger:** Attackers successfully leveraged a real, high-stakes security event (the $88M theft) to bypass user suspicion.
- **Human-in-the-Loop:** The use of live chat operators significantly increases the success rate of social engineering by providing "real-time support" to overcome technical hurdles (like UAC prompts).
## Recommendations
- **Verify Communication:** Always verify security alerts through the official manufacturer’s website or signed social media accounts (e.g., Coinkite’s official X account).
- **Hardware Security:** Remember that hardware wallet audits are typically performed via firmware updates, not by running `.bat` files on a Windows PC.
- **Endpoint Protection:** Use EDR/AV solutions that flag the malicious use of `certutil` and unauthorized remote access tools.