Fake COLDCARD Audit Email Installs a Remote Access Tool

The email landed while COLDCARD owners were already refreshing block explorers in a panic. Subject line: "Hardware audit now available." Sender: compliance@coldcardteamnews.com. It read like precisely the message you would want from your hardware wallet vendor in the week after a firmware bug emptied thousands of wallets. It was not from COLDCARD. It was a delivery mechanism for a commercial remote access tool, and Proofpoint spotted it in early August 2026.

Key Takeaways

• Proofpoint documented a phishing campaign in August 2026 impersonating COLDCARD, with the subject "Hardware audit now available" sent from compliance@coldcardteamnews.com.
• The lure exploits a real COLDCARD firmware random number generator flaw that Galaxy Research tied to roughly $88.6 million in Bitcoin drained from 4,585 addresses.
• Victims land on coldcardcompliance.com and download a 25.7 MB file called Coldcard_Diagnostic_Tool.bat, which requests administrator rights through a UAC prompt.
• The batch file extracts two Base64 encoded payloads into a Windows temp folder, installs ConnectWise ScreenConnect via setup.msi, and runs a genuine signed DocuSign driver installer as a decoy.
• The ScreenConnect instance connects to activeretirementrelocation[.]com, handing the operators interactive control of the machine.

What Did the Fake COLDCARD Audit Email Say?

It claimed a fleet wide security audit was underway and that the recipient's participation was required. As reported by BleepingComputer, the body read: "We are writing to inform you of a coordinated security audit now underway across the COLDCARD device network. Recent findings have prompted us to verify the integrity of hardware across all revisions, and your participation is needed."

Recipients were sent to coldcardcompliance.com, presented as a "Security Verification & Incident Reporting Tool," and given an August 10 deadline. The page sounded trustworthy in exactly the terms a wallet owner would test it against. The process was described as air gapped. It promised, explicitly, never to ask for a recovery seed.

That promise was kept, and that is the interesting part. The operators skipped the seed phrase because they did not need it. The site even ran a live chat staffed by a human who walked hesitant visitors through the steps.

Why Was This Lure So Convincing?

Because the crisis it referenced was real, recent, and enormous. Days earlier, researchers traced a March 2021 firmware error that routed COLDCARD seed generation to MicroPython's deterministic Yasmarang generator instead of the STM32 hardware RNG. Block's engineering team published a technical breakdown of the predictable RNG fallback and 32 bit reseed.

Galaxy Research linked an initial drain of roughly 1,083 BTC, about $70.2 million, across 1,196 addresses on July 30, 2026. Later waves pushed the estimate to 1,367.05 BTC, around $88.6 million, across 4,585 addresses. The audience was pre panicked and actively looking for vendor instructions. This is the same playbook that followed the Ledger data breach and its long tail of crypto phishing, and the same one behind the fake Ledger app that reached the Apple App Store. Hardware wallet incidents now come with a phishing wave attached as reliably as an aftershock follows an earthquake.

How Did the Batch File Install ScreenConnect?

The batch file carried its own payloads inside itself as Base64 text, decoded them to disk with a built in Windows utility, and ran the installer. Here is the chain step by step:

• The site served Coldcard_Diagnostic_Tool.bat, hosted on GitHub, weighing 25.7 MB.
• On execution the script checked for administrator rights and triggered a UAC prompt if it lacked them.
• It decoded two embedded Base64 blobs with certutil, writing setup.msi and docusign.exe into a randomly named Windows temp directory.
• setup.msi installed ConnectWise ScreenConnect and pointed it at the C2 server activeretirementrelocation[.]com.
• docusign.exe, a genuine signed DocuSign printer driver installer, ran in the foreground so the user saw a plausible setup wizard.
• The script then deleted the temp files.

The file size is the tell. A normal batch script is a few kilobytes of text; this one is roughly ten thousand times larger, because Base64 inflates binary content by about a third and both payloads ride inside the script. Decoding embedded data with a signed system binary is catalogued by MITRE as Deobfuscate/Decode Files or Information (T1140), and certutil is one of its best known living off the land implementations.

Why Use ScreenConnect Instead of Custom Malware?

Because it is signed, legitimate, and frequently allowlisted by the very security tools meant to stop it. ScreenConnect is a real remote monitoring and management product used by real IT departments, so its binaries carry valid certificates and its traffic resembles sanctioned support activity.

The shift is measurable. Huntress recorded a 277% jump in RMM abuse during 2025, with RMM software present in 24% of the incidents it observed. Proofpoint tracks the same movement in its research on RMM tooling as an attacker's first choice, and Microsoft documented parallel campaigns in which signed malware impersonating workplace apps deploys RMM backdoors. CISA added a ScreenConnect flaw, CVE-2024-1708, to its Known Exploited Vulnerabilities catalog after confirmed in the wild abuse.

Most coverage frames this as a crypto story. That undersells it. A RAT with administrator rights does not care what is in your wallet: it reaches your browser session cookies, your password manager and your mailbox. The same pattern showed up in the fake Claude Desktop installer that delivered SectopRAT earlier this year. Bitcoin was the bait. The machine was the prize.

What This Means for Your Inbox

Every element of this attack that mattered arrived by email. The lookalike sender domain, the deadline, the link to the cloned site: none of it required a software vulnerability, and none of it would have worked without a plausible message reaching a worried person's inbox.

The uncomfortable detail is how well the lure defeated conventional advice. Wallet owners are trained to check one thing above all others: whether something asks for the recovery seed. This campaign never did, and advertised that fact in writing. It also claimed to be air gapped, borrowing the exact vocabulary self custody users treat as a safety marker. Attackers read the same security guides their targets do.

Timing is the second lesson. The emails went out within days of disclosure, while official channels were still fragmentary. Any vendor security incident big enough to make the news should be treated as a scheduled phishing event. The same dynamic drove the fake LastPass and Bitwarden security alerts that circulated after those password managers made headlines.

How Do You Avoid This Class of Attack?

Treat any emailed instruction to run a diagnostic program as hostile until proven otherwise, then verify through a channel the email did not give you. Concretely:

• Read the full sender domain, not the display name. coldcardteamnews.com is not coldcard.com, and neither is coldcardcompliance.com.
• Reach the vendor by typing the address you already know, never through a link in an alert about that vendor.
• Distrust deadlines. A fixed date such as August 10 exists to stop you from checking.
• Refuse UAC prompts you did not initiate. A hardware audit does not need administrator rights on your desktop.
• Hunt for unexpected ScreenConnect installations. ConnectWise publishes security advisories and guidance; alert on unmanaged instances and outbound traffic to unfamiliar relay domains.
• Be sceptical of live chat on a page you reached from an email. It is a pressure device, the same one used in ClickFix campaigns that talk users into running commands themselves.

If this batch file worked against COLDCARD owners, it will work against Trezor and Ledger owners the moment either brand has a bad week. Nothing in the chain is wallet specific. Swap the branding, keep the payload, and the campaign runs again. The defence that generalises is not recognising this particular email; it is refusing to let any email decide what runs on your computer.