COLDCARD Phishing Campaign Uses Live Chat and RMM Software to Steal Crypto

In the wake of a catastrophic security incident involving a critical hardware vulnerability that resulted in the theft of over 1,300 Bitcoin—valued between $88.6 million and $130 million—cybersecurity researchers at Proofpoint have uncovered an active and highly targeted campaign exploiting community-wide panic. Threat actors have launched a sophisticated COLDCARD phishing campaign designed to trick hardware wallet owners into surrendering host-level control of their systems. By capitalizing on legitimate fears surrounding hardware security flaws, the attackers distribute malicious binaries disguised as official audit utilities, utilizing live human operators to guide victims through administrative security bypasses and deploying persistent Remote Monitoring and Management (RMM) software.

Contextual Threat Landscape: Exploiting Hardware Vulnerability Panic

The cryptocurrency ecosystem relies heavily on hardware cold storage under the baseline assumption that air-gapped cryptographic signing devices provide an impenetrable barrier against remote network exploitation. However, when systemic vulnerabilities emerge within hardware firmware—such as the recent entropy generation flaws affecting specific COLDCARD wallet models—the resulting community anxiety creates a fertile environment for social engineering attacks.

Following public advisories confirming multi-million-dollar illicit wallet drains, hardware wallet owners rushed to verify the cryptographic integrity of their devices. Recognizing this heightened state of alarm, threat actors adapted their tactical playbook. Rather than relying on traditional automated phishing templates or standard credential harvesters, the adversaries engineered a high-touch, multi-stage operation. The campaign exploits the psychological urge for immediate remediation, weaponizing official-sounding compliance terminology to bypass standard user skepticism and security protocols.

Anatomy of the COLDCARD Phishing Campaign

The operation initiates with carefully targeted spear-phishing emails sent to digital asset holders and hardware wallet users. The attackers utilize spoofed email domains, such as compliance@coldcardteamnews.com, to impersonate official corporate security communications from the wallet manufacturer. With urgency-driven subject lines such as “Hardware audit now available”, the emails convey critical importance while mirroring authentic corporate advisories.

The message body informs recipients that due to recent security disclosures, the manufacturer is conducting a mandatory, “coordinated security audit” across all hardware revisions to verify device integrity. To maximize target compliance and suppress suspicion, the lures incorporate specific psychological triggers designed to disarm defense mechanisms:

• Artificial Strict Deadlines: Targets are informed that they must complete the hardware audit before a specified cutoff date (such as August 10) to protect their assets from vulnerability exploitation.
• False Assurances of Security: The phishing lure explicitly reassures recipients that the “Security Verification & Incident Reporting Tool” operates in an air-gapped capacity and will never request recovery seed phrases (12 or 24 words).
• Direct Web Calls-to-Action: The message features embedded hyperlinked buttons directing targets to external web portals hosting the fake audit executable.

Human-Operated Social Engineering and Live Web Chat

While traditional phishing pipelines rely on static landing pages and automated scripts, this campaign elevates social engineering sophistication by integrating human-operated support infrastructure. When targets click the call-to-action link, they are directed to coldcardcompliance.com, an exquisitely cloned replica of the official hardware wallet portal featuring a prominent “Start Hardware Audit” button.

Crucially, the phishing site embeds a functional, live customer support chat interface. Unlike automated chatbots that rely on pre-programmed decision trees, this chat widget is actively staffed by real human threat actors operating in real time. When hesitant users express doubts or encounter administrative hurdles during execution, the live chat operators step in to provide direct, tailored technical guidance.

The threat actors systematically dismantle host-level security protections by walking targets through the following operational steps:

1. System Triage: The live operator asks whether the victim is running Windows or macOS to deliver operating-system-specific instructions and file execution paths.
2. User Account Control (UAC) Bypass Guidance: When Windows presents native administrative consent prompts or SmartScreen warnings, victims frequently hesitate. The operator immediately intervenes, assuring the user that elevated administrative privileges are required for low-level hardware diagnostics and cryptographic verification.
3. Interactive Execution Support: The operator remains in active chat until the victim approves administrative elevation and confirms that the downloaded executable has completed processing.

Technical Execution Path and Payload Delivery Mechanics

The technical architecture of the attack relies on living-off-the-land techniques, legitimate administrative software, and decoy installation routines to evade Endpoint Detection and Response (EDR) platforms. Once the target clicks “Start Hardware Audit”, a batch script hosted on an external code repository (such as GitHub) is downloaded to the victim’s host machine.

The execution pipeline follows a structured multi-stage sequence designed to obfuscate file delivery and establish persistent control:

1. Staging and Obfuscation via CertUtil

The batch script creates a temporary working directory within the local user profile (typically under %TEMP%). It then invokes the native Windows utility certutil.exe to decode base64-encoded payload blocks dropped into the temporary directory. By utilizing native Windows binaries for file decoding, the attack minimizes raw executable transfers across network boundaries that could trigger perimeter detection rules.

2. Dual Binary Deployment and Decoy Execution

The decoding routine yields two distinct files: setup.msi and docusign.exe. The script immediately launches docusign.exe, which functions as a forensic decoy. This binary is a legitimate, signed executable that silently installs a DocuSign printer driver while rendering an “Installation Complete” dialog box on the screen. This visual cue misleads the target into believing the hardware audit tool finished its task successfully.

3. Persistent RMM Installation

Concurrently, the batch file executes setup.msi in the background without user intervention. This installer deploys ConnectWise ScreenConnect (formerly ConnectWise Control), a legitimate commercial Remote Monitoring and Management (RMM) platform. Because ScreenConnect is an authorized administrative utility frequently used by enterprise IT departments, standard antivirus solutions rarely flag the background installation as malicious.

The technical indicators and operational parameters associated with this campaign include:

• Spoofed Email Sender: compliance@coldcardteamnews.com
• Phishing Landing Portal: coldcardcompliance.com
• Command and Control (C2) Server: activeretirementrelocation[.]com
• Dropped Payload Identifiers: setup.msi (ConnectWise ScreenConnect Installer) & docusign.exe (Decoy Driver Installer)
• Primary Evasion Vectors: Native certutil.exe base64 decoding, signed decoy driver execution, and human-guided UAC bypass.

Impact Analysis: Full System Takeover and Digital Asset Theft

Once the ConnectWise ScreenConnect agent finishes installation, it initiates an persistent outbound encrypted session to the threat actors’ command and control server at activeretirementrelocation[.]com. Because outbound connection attempts originating from signed remote support software rarely trigger restrictive firewall blocks, the attackers gain unrestricted, interactive graphical remote desktop control over the victim’s machine.

With persistent host access established, threat actors can carry out severe post-exploitation activities:

• Credential and Token Harvesting: Attackers extract saved browser credentials, stored session cookies, and authentication tokens to hijack web sessions and bypass multi-factor authentication (MFA) on digital asset exchanges.
• Clipboard Hijacking and Address Manipulation: Adversaries monitor system clipboard activity to substitute destination crypto addresses during live transactions.
• Private Key and Software Wallet Extraction: Attackers scan local file systems for software wallet keys, seed backups, and unencrypted key files, exporting them to drain connected accounts.
• Follow-on Malware Deployment: The persistent RMM instance acts as a initial foothold, enabling attackers to deploy keyloggers, information stealers, or secondary ransomware payloads across local network segments.

Defensive Countermeasures and Incident Mitigation

Mitigating threats that combine human-operated social engineering with legitimate remote administrative tools requires a defense-in-depth model spanning host controls, network filtering, and security awareness.

1. Remote Management Tool Governance: Enterprise security teams should implement strict Application Control policies (such as AppLocker or Windows Defender Application Control) to block unauthorized executions of ScreenConnect and unapproved RMM tools on endpoints.
2. Monitor Native Binary Execution: Detection engineering teams should monitor command-line activity for certutil.exe, specifically alerting on invocations featuring -decode or -urlcache flags executed by non-standard parent processes or batch scripts.
3. Network Domain Blocking: Security Operations Centers (SOCs) should actively block known infrastructure domains, including activeretirementrelocation[.]com and coldcardcompliance.com, while auditing outbound connections to unauthorized ScreenConnect instances.
4. Strict Hardware Security Protocols: Hardware wallet users must maintain strict operational security: never execute third-party software tools or scripts to audit hardware devices. Official hardware updates and diagnostic procedures are delivered exclusively through verified software applications or flashed directly on the air-gapped hardware device itself.