--- title: COLDCARD security audit phishing attack installs remote... description: A phishing campaign is exploiting fears around a recently disclosed COLDCARD hardware wallet vulnerability and an $88.6 million Bitcoin theft. Attackers send... canonical: https://daily.dev/posts/coldcard-security-audit-phishing-attack-installs-remote-access-tool-refdomo43 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: COLDCARD security audit phishing attack installs remote access tool | daily.dev og:description: A phishing campaign is exploiting fears around a recently disclosed COLDCARD hardware wallet vulnerability and an $88.6 million Bitcoin theft. Attackers send... og:url: https://daily.dev/posts/coldcard-security-audit-phishing-attack-installs-remote-access-tool-refdomo43 og:image: https://api.daily.dev/og/posts/rEFDOmo43.png og:image:alt: COLDCARD security audit phishing attack installs remote access tool og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # COLDCARD security audit phishing attack installs remote access tool **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 4 min read · 1 upvotes · 0 comments ## Summary A phishing campaign is exploiting fears around a recently disclosed COLDCARD hardware wallet vulnerability and an $88.6 million Bitcoin theft. Attackers send emails impersonating COLDCARD, claiming a security audit is underway and urging recipients to download a 'diagnostic tool.' The downloaded batch file silently installs ConnectWise ScreenConnect, a legitimate remote management tool repurposed as a RAT, connecting to an attacker-controlled C2 server. A DocuSign printer driver is installed as a decoy. Live human operators in a fake customer support chat guide hesitant victims through the installation. Once connected, attackers can steal data, drain cryptocurrency, or deploy ransomware. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the coldcardcompliance.com phishing scam and how does it install malware? It is a phishing campaign impersonating COLDCARD hardware wallet with fake security audit emails from compliance@coldcardteamnews.com, directing victims to coldcardcompliance.com. A live chat operator convinces users to run Coldcard_Diagnostic_Tool.bat, which decodes embedded files into setup.msi and docusign.exe, installing ConnectWise ScreenConnect remote access software while a legitimate DocuSign driver installer acts as a decoy. _Hardware wallet users watching for scams tied to crypto thefts can follow security breakdowns like this on daily.dev._ ### What command-and-control server does the fake COLDCARD audit malware connect to? The ScreenConnect installer dropped by the fake COLDCARD diagnostic tool connects to activeretirementrelocation[.]com, which Proofpoint identified as the threat actor's command-and-control server. Once connected, attackers gain remote access to the victim's machine and can steal data or cryptocurrency, or deploy additional malware including ransomware. _Security teams tracking new phishing infrastructure and C2 domains can follow incident writeups like this on daily.dev._ ### How much Bitcoin was stolen in the COLDCARD RNG vulnerability theft that phishers are now exploiting? Attackers stole approximately 1,367 Bitcoin, worth an estimated $88.6 million, from 4,585 addresses, exploiting a random number generation flaw affecting multiple COLDCARD hardware wallet models and firmware versions. A separate phishing campaign now exploits fear of this theft by impersonating a COLDCARD security audit to trick users into installing remote access malware. _Crypto wallet users assessing hardware vulnerabilities and follow-on scams can track developments like this on daily.dev._ ## Similar posts on daily.dev - [Don’t trust TrustConnect: This fake remote support tool only helps hackers](https://daily.dev/posts/don-t-trust-trustconnect-this-fake-remote-support-tool-only-helps-hackers-ub5pflddg) · CSO Online · 0 upvotes · 0 comments - [Fake Bank of America Phishing Emails Found Delivering Disguised ScreenConnect RAT via UAC Bypass](https://daily.dev/posts/fake-bank-of-america-phishing-emails-found-delivering-disguised-screenconnect-rat-via-uac-bypass-cegwiaiei) · IT Security Guru · 0 upvotes · 0 comments - [The Crypto Wallet That Never Opened: Tampered Exodus Installer Hides a Modular RAT](https://daily.dev/posts/the-crypto-wallet-that-never-opened-tampered-exodus-installer-hides-a-modular-rat-az9eaqjiz) · Huntress Blog · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#crypto](https://daily.dev/tags/crypto), [#malware](https://daily.dev/tags/malware), [#phishing](https://daily.dev/tags/phishing) [View this post on daily.dev](https://daily.dev/posts/coldcard-security-audit-phishing-attack-installs-remote-access-tool-refdomo43) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"COLDCARD security audit phishing attack installs remote access tool","url":"https://daily.dev/posts/coldcard-security-audit-phishing-attack-installs-remote-access-tool-refdomo43","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/coldcard-security-audit-phishing-attack-installs-remote-access-tool-refdomo43"},"datePublished":"2026-08-05T17:52:41.276Z","dateModified":"2026-09-14T08:05:26.989Z","description":"A phishing campaign is exploiting fears around a recently disclosed COLDCARD hardware wallet vulnerability and an $88.6 million Bitcoin theft. Attackers send...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/99807057a6061b4ac5d37e5ec944b6a6?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/99807057a6061b4ac5d37e5ec944b6a6?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/coldcard-security-audit-phishing-attack-installs-remote-access-tool-refdomo43","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,crypto,malware,phishing","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"COLDCARD security audit phishing attack installs remote access tool"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/coldcard-security-audit-phishing-attack-installs-remote-access-tool-refdomo43#faq","mainEntity":[{"@type":"Question","name":"What is the coldcardcompliance.com phishing scam and how does it install malware?","acceptedAnswer":{"@type":"Answer","text":"It is a phishing campaign impersonating COLDCARD hardware wallet with fake security audit emails from compliance@coldcardteamnews.com, directing victims to coldcardcompliance.com. A live chat operator convinces users to run Coldcard_Diagnostic_Tool.bat, which decodes embedded files into setup.msi and docusign.exe, installing ConnectWise ScreenConnect remote access software while a legitimate DocuSign driver installer acts as a decoy. Hardware wallet users watching for scams tied to crypto thefts can follow security breakdowns like this on daily.dev."}},{"@type":"Question","name":"What command-and-control server does the fake COLDCARD audit malware connect to?","acceptedAnswer":{"@type":"Answer","text":"The ScreenConnect installer dropped by the fake COLDCARD diagnostic tool connects to activeretirementrelocation[.]com, which Proofpoint identified as the threat actor's command-and-control server. Once connected, attackers gain remote access to the victim's machine and can steal data or cryptocurrency, or deploy additional malware including ransomware. Security teams tracking new phishing infrastructure and C2 domains can follow incident writeups like this on daily.dev."}},{"@type":"Question","name":"How much Bitcoin was stolen in the COLDCARD RNG vulnerability theft that phishers are now exploiting?","acceptedAnswer":{"@type":"Answer","text":"Attackers stole approximately 1,367 Bitcoin, worth an estimated $88.6 million, from 4,585 addresses, exploiting a random number generation flaw affecting multiple COLDCARD hardware wallet models and firmware versions. A separate phishing campaign now exploits fear of this theft by impersonating a COLDCARD security audit to trick users into installing remote access malware. Crypto wallet users assessing hardware vulnerabilities and follow-on scams can track developments like this on daily.dev."}}]} ```