COLDCARD Audit Phishing: 25.7MB Batch File Embeds ScreenConnect and Uses Chat to Trick Admins into Running It

1. Basic Information

• 
  Article Title: COLDCARD security audit phishing attack installs remote access tool


• 
  Publisher: BleepingComputer


• 
  Publication Date: August 5, 2026


• 
  Original Source: BleepingComputer
  


• 
  Related Information Source: Proofpoint (campaign discovery and IOC sharing)


• 
  Related Malware and Tools: ConnectWise ScreenConnect, Coldcard_Diagnostic_Tool.bat, setup.msi, docusign.exe, certutil.exe, PowerShell


• 
  Related Products and Services: COLDCARD hardware wallet, GitHub, Windows, DocuSign printer driver


• 
  Related CVE and Threat Group: No CVE. Threat group not identified.


• 
  Severity: High

Attackers used recent news about COLDCARD random number issues and the theft of about 88.6 million dollars in Bitcoin. They contacted hardware wallet users and pretended to run a security audit before August 10. The targets did not need to give their recovery seeds, so they thought the email was real. A live chat operator guided them until they approved the UAC prompt.

2. One-Sentence Summary

A fake security audit email and support chat trick users into feeling safe. The user downloads a large batch file from GitHub. The file contains a hidden ScreenConnect MSI installer. The system uses certutil to decode and install it with administrator rights. This leads to remote control via a legitimate RMM tool, cryptocurrency theft, and potential follow-up malware or ransomware.

3. Attack Flow

Chain A: Audit Notice to Chat Guidance

1. The attacker sends an email from [email protected] with the subject Hardware audit now available.


2. The email states that an urgent audit is required for all hardware revisions, with a deadline of August 10.


3. It directs the user to a fake Security Verification & Incident Reporting Tool at coldcardcompliance.com.


4. It lowers the user's guard by saying the process is "air-gapped" and "does not ask for recovery seeds."


5. A live chat operator checks if the user is on Windows or macOS.


6. The operator answers questions about black windows or UAC prompts in real time and tells the user to run the tool.

Chain B: Batch File to RMM Deployment

1. The user clicks Start Hardware Audit and downloads a 25.7MB file named Coldcard_Diagnostic_Tool.bat from GitHub.


2. The batch file shows a fake diagnostic screen and checks for administrator rights.


3. If the user is not an administrator, the script restarts itself using PowerShell and asks for UAC elevation.


4. It saves embedded Base64 data to a random temporary directory.


5. It uses certutil to decode setup.msi and docusign.exe.


6. It installs the ScreenConnect client using setup.msi.


7. It installs the DocuSign printer driver using the legitimate signed docusign.exe file to show a decoy screen.


8. It shows an Installation Complete message and deletes the temporary directory.

Chain C: Remote Control

1. ScreenConnect connects to activeretirementrelocation[.]com.


2. The attacker takes remote control of the device.


3. The attacker can search for wallets, credentials, and data, deploy more malware, or send cryptocurrency.


4. Ransomware deployment is possible under certain conditions, but the article does not confirm later damage.

4. Attacker Locations and Execution Sites

• 
  Guidance: Fake sender domain, fake COLDCARD site, live chat


• 
  Payload Distribution: Attacker-controlled GitHub account


• 
  Execution Site: Victim's Windows device


• 
  Privilege Escalation: PowerShell self-relaunch and UAC prompt


• 
  Remote Access / C2: ScreenConnect server activeretirementrelocation[.]com
  


• 
  Decoy: Legitimate signed DocuSign printer driver installer

5. What Victims and Administrators See

The user sees an urgent audit from the hardware wallet vendor, live chat support, a black diagnostic window, a UAC prompt, a DocuSign driver, and a completion message. The SOC sees a batch file download, PowerShell elevation, certutil decoding, an MSI installation, a ScreenConnect service/client, and persistent traffic to an unknown domain. Because the attack uses a legitimate RMM and a signed decoy, simple malware hash checks easily miss it.

6. Success and Failure Conditions

Success Conditions

• A COLDCARD user trusts the fear-based email.


• The user clicks the email link or visits the fake site.


• The user downloads and runs the batch file.


• The user approves the UAC prompt.


• ScreenConnect installation and C2 egress are allowed.


• RMM application control is not installed.

Failure Conditions

• The user checks the vendor domain, electronic signature, or official announcements through another channel.


• The email or web gateway blocks the sender, domain, or payload.


• EDR blocks the batch, PowerShell, certutil, and MSI chain.


• The network restricts the installation, service, and egress of unauthorized RMM tools.


• Standard user accounts are enforced and UAC requests are denied.

7. What Happens on Success

Through ScreenConnect, the attacker can control the device using the same screen and permissions as the user. They can search the wallet application, browser, password manager, clipboard, and local files. They can steal cryptocurrency, credentials, and data, and deploy additional payloads or ransomware. The public article does not confirm specific damage after the ScreenConnect connection.

8. Observable Logs

Email

• Sender: [email protected]
  


• Subject: Hardware audit now available
  


• Body emphasizes audit deadlines, air-gapped status, and no requirement for seeds.


• Link to coldcardcompliance.com.

Proxy / SWG / DNS

• coldcardcompliance.com


• Download of .bat file from the attacker's GitHub account


• ScreenConnect traffic to activeretirementrelocation[.]com
  

Endpoint / EDR

• Coldcard_Diagnostic_Tool.bat


• Batch file launching PowerShell for self-elevation


• Base64 decoding using certutil
  


• 
  setup.msi and docusign.exe inside a random %TEMP% directory


• MSI installation, ScreenConnect service/client creation


• Deletion of the temp directory

Identity / IdP

• No corporate identity used in the early stages.


• Remote operator browser and credential access are subjects for later investigation.

SaaS / Cloud

• GitHub repository or account download audits are hard for organizations to collect.


• If available, ScreenConnect session and server logs should be preserved.

Network

• ScreenConnect-specific persistent connection


• Remote access server connection right after installation


• Later traffic to wallets, exchanges, or additional payloads

9. Attack Success Stages

• 
  Contact Only: Received fake audit email


• 
  User Action: Clicked link, visited fake site, downloaded batch file


• 
  Initial Execution: Ran batch file, showed diagnostic screen


• 
  Privilege Gain: Approved UAC and re-ran as administrator


• 
  Malware / RMM Success: Installed ScreenConnect, registered service, connected to C2


• 
  Session Compromise: Started remote session, operator ran commands, keyboard, or mouse actions


• 
  Data Theft: Confirmed access and outbound transfer of wallets, credentials, and files


• 
  Follow-on Compromise: Confirmed cryptocurrency transfer, additional malware, or ransomware

10. Investigation Playbook

Trigger

• COLDCARD audit email


• Coldcard_Diagnostic_Tool.bat


• Unauthorized ScreenConnect


• activeretirementrelocation[.]com

Initial Checks

1. Preserve email headers, body, URLs, attachments, and downloads.


2. Record the exact times of clicks, downloads, execution, and UAC prompts.


3. Check the ScreenConnect installation time and the first C2 connection.

Device

• Process tree for batch, PowerShell, certutil, and msiexec
  


• Temporary files, MSI products/services, and ScreenConnect configuration


• Processes, files, browser history, and clipboard artifacts during the remote session


• Wallet applications, exchange access, and additional payloads

Authentication and Cloud

• Create an inventory of passwords, browser sessions, and wallet keys found on the endpoint.


• Revoke and rotate sessions for exchanges, email, cloud services, and password managers.


• Check cryptocurrency transactions.

Follow-up Actions

• Look for additional persistence, scheduled tasks, services, and new user accounts.


• Check for ransomware tools, data staging, and remote commands.


• Search for other recipients of the same email campaign.

Containment

• Isolate the device from the network.


• Preserve evidence before stopping the ScreenConnect service.


• Block the domain, sender, and GitHub URL.


• Consider moving cryptocurrency assets to a new wallet on a clean device.


• Rotate all credentials and sessions.

Assessment Categories

• Phishing Delivered / Link Clicked / Script Executed / Elevated / ScreenConnect Connected / Remote Session Confirmed / Data or Crypto Theft Confirmed / Follow-on Malware Confirmed

11. Defense and Detection Ideas

Single Events

• PowerShell elevation triggered by a .bat file


• 
  certutil decoding triggered by a batch file or PowerShell


• MSI installation inside a temporary folder


• New ScreenConnect service creation

Timeline Correlation

email → fake site → GitHub batch → UAC → certutil → msiexec → ScreenConnect service → remote C2

Threat Hunting Focus

• Matching subjects, senders, and domains


• Large batch files around 25MB with embedded Base64 data


• Connection to an unknown server immediately after installing a legitimate RMM


• Simultaneous execution of a DocuSign decoy and ScreenConnect

Log Gaps

• Email click telemetry


• Complete command lines and script block logs


• MSI and service installation events


• RMM session and operator logs


• Wallet application access

Priority Countermeasures

• Allowlist or block unauthorized RMM tools


• EDR rules for the batch → LOLBins → MSI chain


• Procedures to verify urgent hardware wallet notifications


• Training for standard user accounts and UAC prompts


• Incident response procedures for cryptocurrency users

12. Facts, Inference, and Hypothesis

Facts

• Proofpoint discovered a campaign impersonating COLDCARD.


• A fake site and live chat guided users until they approved UAC.


• The 25.7MB batch file contained two Base64 files.


• 
  certutil decoded a ScreenConnect MSI and a legitimate DocuSign decoy.


• ScreenConnect connected to activeretirementrelocation[.]com.


• Subsequent data or cryptocurrency theft and ransomware are capabilities; actual damage was not confirmed in the article.

Inference

• Explaining that recovery seeds are not required is designed to bypass the caution of security-aware hardware wallet users.


• Live operators change their guidance based on technical warnings to bypass static training.

Hypothesis

• Data on COLDCARD buyers or cryptocurrency enthusiasts might have been used for target selection.


• Campaigns impersonating other brands might be launched from the same ScreenConnect server.

13. MITRE ATT&CK Mapping

High Confidence

• 
  T1566.002 Spearphishing Link


• 
  T1204.002 Malicious File


• 
  T1059.003 Windows Command Shell


• 
  T1059.001 PowerShell


• 
  T1140 Deobfuscate/Decode Files or Information


• 
  T1218.013 (Note: certutil is best treated as T1140/T1105 rather than Mavinject, etc.)


• 
  T1219.002 Remote Access Software


• 
  T1543.003 Windows Service


• 
  T1105 Ingress Tool Transfer

Medium Confidence

• 
  T1036 Masquerading: Diagnostic and DocuSign decoys


• 
  T1071.001 Web Protocols: ScreenConnect traffic


• 
  T1555 Credentials from Password Stores: Follow-up capability, execution unconfirmed


• 
  T1657 Financial Theft: If cryptocurrency theft is completed


• 
  T1486 Data Encrypted for Impact: Ransomware deployment unconfirmed

14. Unknowns and Additional Investigation

• Number of campaign emails sent, target regions, and recipient sources


• Hashes of the batch file, MSI, and docusign.exe
  


• GitHub account and repository URLs


• ScreenConnect tenant and operator identities


• Commands and data theft after the remote session


• Actual cryptocurrency losses


• Payloads presented to macOS users

15. Impact on SOCs and General Enterprises

Legitimate remote management tools are common for support purposes in many organizations, and security teams often cannot block ScreenConnect simply as an IOC. Analysts must combine installation origins, parent processes, initial connection destinations, and approved RMM inventories. Employees, executives, and developers who handle cryptocurrency can become targets even on enterprise devices, so teams should not dismiss personal asset fraud as outside the scope of a corporate SOC.

16. Summary for SOCs, Administrators, and Users

For SOCs

• Detect the batch → PowerShell → certutil → MSI → ScreenConnect chain as a single sequence.


• Treat unauthorized RMM tools as high-priority investigations, even if they are digitally signed.


• Check endpoints, email, and wallet/exchange access together.

For Administrators

• Enforce RMM allowlists and monitor service installations.


• Verify urgent hardware wallet notifications through official channels.


• Completely rotate credentials and sessions on infected devices.

For Users

• Do not download tools or approve UAC prompts from email links, even if sent by a hardware wallet vendor.


• Just because a tool does not ask for your recovery seed does not mean it is safe.


• If you run the file, disconnect the device from the network and contact the security team from a clean device.