Loading story…
Attackers are impersonating COLDCARD in a phishing campaign that exploits concern over a recently disclosed wallet security issue and a suspected $88.6 million Bitcoin theft, urging users to complete a supposed hardware security audit. Victims are directed from email messages to a fake compliance site and told to download a Windows “diagnostic tool,” while live chat operators reportedly help guide them through the process and persuade them to approve administrator prompts.
Analysis of the fake tool found a batch file, Coldcard_Diagnostic_Tool.bat, that uses PowerShell and certutil to unpack payloads and install ConnectWise ScreenConnect from an attacker-controlled server, while showing decoy activity such as a legitimate signed DocuSign printer driver installer. Researchers said the campaign is separate from legitimate COLDCARD firmware or seed-migration workflows, and warned that affected systems should be treated as remotely exposed because the access could enable data theft, cryptocurrency theft, additional malware deployment, or ransomware.
Get the infrastructure and lures behind it.
4 events from the most recent confirmed update back to the earliest known activity.
The fake compliance site included a live customer service chat where operators asked victims whether they used Windows or macOS and instructed Windows users to run the downloaded tool. When victims encountered an administrator prompt, the operators told them to click "Yes," and Proofpoint assessed the chats were likely handled by real people.
The phishing emails directed victims to coldcardcompliance.com, which impersonated COLDCARD and offered a supposed hardware audit tool. Clicking "Start Hardware Audit" downloaded Coldcard_Diagnostic_Tool.bat, which unpacked setup.msi and docusign.exe, installed ConnectWise ScreenConnect, and connected to activeretirementrelocation.com for attacker-controlled remote access.
Proofpoint discovered a phishing campaign impersonating COLDCARD and exploiting publicity around the wallet vulnerability and suspected Bitcoin theft. The emails used compliance@coldcardteamnews.com and the subject line "Hardware audit now available" to lure targets to a fake audit process.
Attackers recently stole approximately 1,367 Bitcoin from 4,585 addresses, valued at an estimated $88.6 million. The theft is believed to be linked to a random number generation flaw affecting multiple COLDCARD models and firmware versions.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
3 references tracked. Mallory keeps watching after this page renders.
trojan-killer.net
Open sourcecyberveille.ch
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported an active **Smoke#Screen** social-engineering campaign that tricks victims into installing the legitimate, ConnectWise-signed **ScreenConnect** remote monitoring and management tool, giving attackers persistent remote access while blending in with normal IT activity. The operation targets both **Windows** and **macOS** users and uses multiple lures, including fake **Zoom** and **Adobe** updates, document-review requests, and a **SystemCheck** maintenance tool. Securonix linked the activity to a live staging server at `207.174.0.143:8080`, reconstructed five kill chains, and tied the campaign to three attacker-controlled ScreenConnect relay clusters. The attackers rotated payloads between download sessions and used a mix of **VBScript droppers**, batch loaders, compiled **.NET** executables, phishing HTML pages, **Dropbox** links, **Cloudflare Quick Tunnels**, encrypted bundles, and a **WsgiDAV** staging server to frustrate hash-, signature-, and reputation-based detection. Researchers said the tradecraft evolved from obfuscated, sandbox-aware droppers to loaders that disabled Microsoft Defender and later to stealthier variants that delayed execution to evade Elastic correlation, underscoring that **behavioral detection** is more effective than relying on software trust or static indicators alone.
Aug 7, 2026
Threat researchers reported multiple phishing-driven intrusions in which attackers impersonate trusted brands and agencies to trick victims into installing legitimate remote monitoring and management (RMM) software for persistent access. In **Operation DoppelBrand**, financially motivated actor **GS7** spoofed Fortune 500 financial and technology brands (including **Wells Fargo** and **USAA**) using more than **150** lookalike domains to harvest credentials and exfiltrate data via attacker-controlled **Telegram bots**; researchers also identified nearly **200** additional domains with short registration terms, automated SSL, wildcard DNS, and brand-specific subdomains supporting the campaign. Separately, Forcepoint X-Labs described a wave of emails impersonating the **U.S. Social Security Administration** that delivers an attached `.cmd` script to weaken Windows defenses and enable silent installation of **ConnectWise ScreenConnect**. The script checks/elevates privileges, disables **Windows SmartScreen** via registry changes, removes **Mark-of-the-Web**, and uses **Alternate Data Streams (ADS)** for stealth before installing an MSI and configuring ScreenConnect (via `System.config`) to beacon to an attacker-controlled server (reported as `dof-connecttop` on port `8041`). Both activity sets highlight a recurring tradecraft pattern: **brand impersonation + scripted defense evasion + abuse of legitimate RMM tooling** (e.g., *LogMeIn Resolve*, *ScreenConnect*) to gain remote control and facilitate follow-on theft or persistence.
Jun 29, 2026
A phishing campaign impersonating **Bank of America** is targeting victims with different payloads based on device type. Huntress reported that non-Windows users are redirected to credential-harvesting pages that solicit usernames, passwords, personally identifiable information, Social Security numbers, government ID details, and payment card data, while Windows users are lured into downloading a fake **"Account Guard"** installer presented as a ZIP file. On Windows systems, the installer launches a multi-stage infection chain using VBScript and layered Base64-decoded PowerShell to download and silently install **ScreenConnect** for persistent remote access. The malware abuses the `ICMLuaUtil` elevated COM interface to bypass UAC and gain administrator privileges without prompting the user, then hides itself as a **"Windows Security"** service, alters uninstall visibility, and modifies **SDDL** and **ACL** settings to hinder removal. Huntress linked the activity to domains including `bkofamerica[.]com`, `kleinschnitg[.]com`, and `sectioncompil[.]com`, and said the ScreenConnect implant communicated with `217.60.195[.]167` over TCP port `8041`.
Aug 11, 2026