Phishing Attack Exploits COLDCARD Wallet RNG Flaw Concerns to Deploy ScreenConnect

Threat actors are actively running a phishing campaign that leverages public concern surrounding a recently disclosed COLDCARD wallet vulnerability to deploy remote access software. By impersonating COLDCARD’s security team and promoting a fake security audit tool, the attackers trick targets into executing a malicious batch script that installs ConnectWise ScreenConnect on Windows machines.

The campaign capitalizes on widespread anxiety following a massive cryptocurrency theft where approximately 1,367 Bitcoin—valued at roughly $88.6 million—was drained from 4,585 wallet addresses. That theft stemmed from an alleged random number generation (RNG) flaw affecting multiple COLDCARD hardware models and firmware versions. When a cryptographic wallet relies on flawed pseudorandom number generators (PRNG) during key creation, the resulting entropy is weak, rendering private keys mathematically predictable and allowing attackers to derive keys offline to steal funds without physical access to the hardware.

Anatomy of the Phishing Lure

Discovered by security firm Proofpoint, the phishing emails are distributed from [email protected] with the subject line “Hardware audit now available.” The messages inform targets that a coordinated security audit is underway across all COLDCARD hardware revisions to verify device integrity following recent security disclosures.

To trick targets into complying, the lure incorporates tactics designed to lower suspicion:

• False Security Guarantees: The email explicitly claims the audit process is air-gapped and will never ask for the user’s recovery seed phrase.
• Artificial Urgency: The message imposes a firm deadline, instructing targets that participation must be completed by August 10.
• Legitimate-Looking Infrastructure: Clicking the “Access the Audit Tool” button directs targets to coldcardcompliance.com, a site masquerading as an official COLDCARD portal with a “Start Hardware Audit” download prompt.

The phishing site also features a live “Customer Service” chat widget. Proofpoint’s analysis indicates these chats are staffed by human operators rather than automated bots. When targets experience friction—such as encountering an administrative User Account Control (UAC) prompt—the live operator directly intervenes, convincing the victim that elevated privileges are required for the audit tool and instructing them to click “Yes.”

Technical Analysis of the Diagnostic Tool

When a user clicks “Start Hardware Audit,” the site fetches a 25.7MB file named Coldcard_Diagnostic_Tool.bat hosted on GitHub. Analysis of the batch script reveals a multi-stage execution flow:

1. Privilege Escalation: Upon launching, the script displays a terminal window claiming to run a diagnostic check while evaluating user privileges. If it lacks administrator rights, it uses PowerShell to relaunch itself with an elevated UAC prompt.
2. Payload Extraction: Embedded directly within the batch file are two Base64-encoded payloads. The script writes these strings to a randomly named subfolder within the Windows %TEMP% directory as setup.msi and docusign.exe, using the native Windows utility certutil.exe to decode them.
3. Decoy Execution: To minimize suspicion, the script executes docusign.exe—a legitimately signed DocuSign printer driver installer—which serves as a decoy while the terminal displays an “Installation Complete” message.
4. RMM Agent Installation: Concurrently, the script runs setup.msi, which silently installs a customized ConnectWise ScreenConnect remote access client.

Once installed, the ScreenConnect agent initiates an outbound connection to the threat actor’s command-and-control (C2) server at activeretirementrelocation[.]com.

Blast Radius and Operational Impact

Remote Monitoring and Management (RMM) software like ConnectWise ScreenConnect is frequently abused by threat actors because signed RMM binaries easily bypass standard antivirus and Endpoint Detection and Response (EDR) software. This “Living off the Land” approach provides persistence while blending into normal system activity.

The target audience for hardware cold storage wallets includes high-net-worth individual investors, web3 organizations, and corporate treasury management teams. If executed on an enterprise or financial workstation, the operational impact includes:

• Direct Financial Loss: Real-time desktop access enables attackers to harvest browser credentials, intercept web session cookies, log keystrokes, and execute clipboard-swapping attacks to modify destination crypto addresses during transactions.
• Network Lateral Movement: Initial access via ScreenConnect gives threat actors a beachhead to map internal network subnets, harvest domain credentials, and escalate privileges across active directory domains.
• Ransomware Deployment: Unfiltered interactive remote control allows attackers to exfiltrate sensitive files and stage enterprise-wide ransomware or wipers.

Defensive Guidance and Mitigations

Security teams and cryptocurrency custody operators should implement the following targeted controls:

• Block Campaign Indicators: Add coldcardcompliance.com, coldcardteamnews.com, and activeretirementrelocation[.]com to network egress blocklists and mail gateway filters.
• Audit RMM Deployments: Inspect endpoint environments for unauthorized installations of ConnectWise ScreenConnect. Search host logs for certutil.exe execution involving Base64 decoding (-decode) within temporary directories, and audit execution of scripts named Coldcard_Diagnostic_Tool.bat.
• Hardware Wallet Security Practices: Hardware wallet vendors do not distribute administrative .bat executables to verify physical device integrity. Hardware audits or firmware verifications are conducted directly on the air-gapped device screen or through verified open-source wallet software (such as Sparrow Wallet or Electrum) connected over USB.

Ensure non-administrative user accounts cannot execute arbitrary PowerShell scripts or bypass UAC prompts without secondary authorization.