Fake COLDCARD Audit Campaign Uses Diagnostic Tool to Install ScreenConnect
Summary
Proofpoint found a campaign impersonating COLDCARD and exploiting concern over a suspected $88.6 million Bitcoin theft. A fake audit tool prompts for elevated access and installs ScreenConnect, potentially giving attackers remote access.
Key points
- Proofpoint identified phishing emails impersonating COLDCARD and claiming a security audit was underway for its hardware wallets.
- The lure exploits concern about a suspected theft of about 1,367 Bitcoin from 4,585 addresses, believed to involve a random-number-generation flaw.
- A fake support site and chat direct Windows users to run a diagnostic tool and approve an administrator prompt.
- The batch file checks for administrator privileges, can relaunch itself through PowerShell with a User Account Control prompt, and extracts embedded files into a temporary directory.
- The MSI installs ConnectWise ScreenConnect; a signed DocuSign executable that installs a printer driver serves as a decoy.
- Proofpoint says ScreenConnect connects to activeretirementrelocation[.]com; the resulting access could enable data theft or further malware deployment, but the article does not establish that these outcomes occurred.
Article Details
- Attack Vectors
- Phishing emails impersonate COLDCARD and direct recipients to a fake audit site with a live support chat that pressures them to run a downloaded batch file.
- The batch file requests elevated permissions, decodes embedded files with certutil, installs ScreenConnect, and launches a DocuSign printer-driver executable as a decoy.
- ScreenConnect connects to the reported command-and-control server, giving the attacker remote access to the victim’s device.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | activeretirementrelocation[.]com | Reported ScreenConnect command-and-control server used by the threat actor. |
| DOMAIN | coldcardcompliance[.]com | Fake COLDCARD audit site used to deliver the diagnostic tool and host the phishing support chat. |
compliance@coldcardteamnews[.]com | Sender address used for phishing emails impersonating COLDCARD. |
MITRE ATT&CK
T1059.001 · PowerShellThe batch file uses PowerShell to relaunch itself when administrator privileges are not present.T1059.003 · Windows Command ShellThe downloaded batch file executes commands to stage and install the payloads.T1105 · Ingress Tool TransferThe batch file is downloaded from a GitHub account, and its execution stages embedded payload files on the device.T1140 · Deobfuscate/Decode Files or InformationThe script decodes embedded Base64 files using Windows certutil.T1204.002 · Malicious FileVictims are instructed to run the downloaded Coldcard_Diagnostic_Tool.bat file.T1219 · Remote Access ToolsThe installed ScreenConnect software provides the attacker with remote access to the device.T1566.002 · Spearphishing LinkPhishing emails direct recipients to the fake audit site through an access button.
Products
ColdcardA phishing campaign is abusing fears around the COLDCARD wallet vulnerability and the suspected $88.6 million Bitcoin theft to lure victims into installing ScreenConnect remote access software.ScreenConnectA phishing campaign is abusing fears around the COLDCARD wallet vulnerability and the suspected $88.6 million Bitcoin theft to lure victims into installing ScreenConnect remote access software.