Phishing Disguised as a COLDCARD Audit Installs a Remote Access Tool

Proofpoint has uncovered a phishing campaign that exploits a recently disclosed COLDCARD hardware wallet vulnerability and the alleged bitcoin theft tied to it. The attackers are estimated to have drained roughly 1,367 BTC (around $88.6 million) from 4,585 addresses, reportedly taking advantage of a flaw in random number generation affecting several COLDCARD models and firmware versions.

The “scheduled audit” email

The attack is built on this wave of anxiety. Victims receive emails from the address compliance@coldcardteamnews.com with the subject line “Hardware audit now available.” Sent in COLDCARD's name, they claim that “recent findings” require verifying the integrity of devices of every revision, and that the recipient's participation is supposedly mandatory. To ramp up the pressure, the scammers set a deadline — the check must be completed by August 10.

Particular care is taken to lull the victim's suspicions: the email assures them that the procedure runs in an isolated (air-gapped) mode and that no one will ever ask for the seed phrase. The “Access the Audit Tool” button leads to a fake site, coldcardcompliance.com, which mimics the official resource.

Live operators instead of a chatbot

The site runs a “customer support” window. Judging by the chat logs Proofpoint shared, real people sit behind it rather than a bot: the operator asks what system the victim has — Windows or macOS — and nudges Windows users into running the downloaded file. When one of the interlocutors noticed a black window and a prompt for administrator rights, the operator calmly explained that this was “needed to begin installation” and advised clicking “Yes.” The live handholding lets them dispel doubts and push waverers over the edge.

What the “diagnostic tool” hides

The “Start Hardware Audit” button downloads a batch file from GitHub, Coldcard_Diagnostic_Tool.bat, 25.7 MB in size. Inside are two Base64-encoded files. When run, the script puts on a show of checking the device, while in the background it determines whether the user has administrator rights; if not, it relaunches itself through PowerShell with a UAC prompt.

The files are then unpacked into a temporary folder under the names setup.msi and docusign.exe and decoded with the built-in certutil utility. docusign.exe is a legitimate, signed installer for a DocuSign printer driver, serving as a distracting front: the user sees an “Installation complete” message, and the temporary directory is deleted. The real payload, however, is setup.msi, which turns out to be an installer for ConnectWise ScreenConnect.

Once remote access is established, the tool connects to the command-and-control server activeretirementrelocation[.]com. From there the attackers can steal data and cryptocurrency, install other software and, as Proofpoint warns, even deploy ransomware.

Source: Bleeping Computer