Coldcard Security Audit Phishing Campaign Installs ConnectWise ScreenConnect RAT

Key facts for Coldcard audit phishing ScreenConnect

Detection coverage for Coldcard audit phishing ScreenConnect

As of 2026-08-05, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1896 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Certutil-Decode Followed by MSIExec ScreenConnect Install — Post-Exploitation Phase

Detects the core post-exploitation chain: Windows certutil.exe used to decode Base64-embedded payloads from a batch file into a temp directory, followed by MSIExec silently installing an MSI (ScreenConnect RAT). Tracks the sequence of cmd.exe spawning certutil -decode then msiexec /i /quiet within a short window — the signature of the Coldcard_Diagnostic_Tool.bat payload execution.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1059.003, T1059.001, T1140, T1218.010, T1548.002, T1070.004
• Data sources: sysmon_process_creation, windows_security_event_4688, device_process_events
• Severity: critical
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (ParentImage="*\\cmd.exe" OR ParentImage="*\\powershell.exe")
  (Image="*\\certutil.exe" OR Image="*\\msiexec.exe")
  (CommandLine="*-decode*" OR CommandLine="*/i*" CommandLine="*/quiet*")
| stats dc(Image) as unique_images, values(CommandLine) as cmds, min(_time) as first_seen, max(_time) as last_seen by ParentImage, ComputerName, ProcessGuid
| where unique_images >= 2
| eval chain_detected=if(mvcount(cmds)>=2 AND match(cmds,"(?i)certutil.*-decode") AND match(cmds,"(?i)msiexec.*/i.*/quiet"),"certutil_decode_to_msiexec","partial")
| where chain_detected="certutil_decode_to_msiexec"
| eval threat_id="TL-2026-1896"
| table _time, ComputerName, ParentImage, cmds, chain_detected, threat_id

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("cmd.exe", "powershell.exe")
| where FileName in~ ("certutil.exe", "msiexec.exe")
| where ProcessCommandLine has_any ("-decode", "/i", "/quiet")
| summarize
    ProcessesMade=makelist(FileName),
    CommandLines=makelist(ProcessCommandLine),
    FirstSeen=min(Timestamp),
    LastSeen=max(Timestamp)
    by DeviceName, InitiatingProcessFileName, InitiatingProcessId
| where ProcessesMade has_all ("certutil.exe", "msiexec.exe")
| extend
    HasCertutilDecode = iff(CommandLines has_any ("-decode"), true, false),
    HasMsiSilentInstall = iff(CommandLines has_any ("/i") and CommandLines has_any ("/quiet"), true, false)
| where HasCertutilDecode and HasMsiSilentInstall
| project-reorder DeviceName, InitiatingProcessFileName, ProcessesMade, CommandLines, FirstSeen, LastSeen

Sigma

title: Certutil Decode Followed by MSIExec Silent Install — ScreenConnect RAT Deployment
id: b7d1e8f4-63c2-4a09-a1f9-3e7bc52a9d04
status: experimental
description: Detects the chain of certutil.exe used to decode Base64-encoded payload followed by msiexec.exe silently installing an MSI within a short window. This is the core delivery mechanism of the Coldcard_Diagnostic_Tool.bat ScreenConnect RAT deployment.
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-05
references:
  - https://www.bleepingcomputer.com/news/security/coldcard-security-audit-phishing-attack-installs-remote-access-tool/
  - https://www.securonix.com/blog/smoke-screen-screenconnect-rmm-abuse-cloudflare-tunnels/
tags:
  - attack.execution
  - attack.t1059.003
  - attack.t1059.001
  - attack.t1548.002
  - attack.defense_evasion
  - attack.t1140
  - attack.t1218.010
  - attack.t1070.004
  - attack.tool.certutil
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\\cmd.exe'
      - '\\powershell.exe'
  selection_certutil:
    Image|endswith: '\\certutil.exe'
    CommandLine|contains: '-decode'
  selection_msiexec:
    Image|endswith: '\\msiexec.exe'
    CommandLine|contains|all:
      - '/i'
      - '/quiet'
  condition: selection_parent and (selection_certutil and selection_msiexec) | near timeframe: 60s
falsepositives:
  - IT administrative scripts that legitimately use certutil -decode followed by MSI installation (rare; typically uses different deployment tools like PDQ, SCCM, or Group Policy)
  - Software deployment via enterprise tools that may chain msiexec after a download script
level: critical

Known false positives:

• IT admin scripts using certutil for legitimate file decoding followed by MSI installation — rare; typical enterprise deployment uses SCCM, PDQ, or GPO rather than cmd.exe chains

Tuning notes: Increase fidelity by requiring certutil -decode to write to a non-standard temp path (e.g., %TEMP%\random_name\). Exclude known IT admin scripts via parent process allowlist (e.g., SCCM client, PDQ). Set correlation window to 60 seconds. Add additional signal if certutil input file is a .bat or .cmd file.

• 🔒 Coldcard Phishing Chain — Email to Suspicious File Download — Exploitation Phase · unlock with TL Creds
• 🔒 Batch File Execution Chain — Cmd to PowerShell UAC Bypass to Certutil Decode to MSIExec — Post-Exploitation Phase · unlock with TL Creds
• 🔒 Non-Enterprise ScreenConnect Service Installation and C2 Beaconing — C2 Phase · unlock with TL Creds
• 🔒 Coldcard Cloned Website and Phishing Payload Download — Exploitation Phase · unlock with TL Creds
• 🔒 ScreenConnect RAT Installation via MSIExec With Decoy Process — Post-Exploitation Phase · unlock with TL Creds
• 🔒 ScreenConnect Service Persistence and Suspicious C2 Relay Communication — C2 Phase · unlock with TL Creds
• 🔒 Coldcard Phishing Email With ScreenConnect Payload Link — Exploitation Phase · unlock with TL Creds
• 🔒 ScreenConnect Outbound C2 Connection to Suspicious Domain — C2 Phase · unlock with TL Creds

Indicators of compromise for Coldcard audit phishing ScreenConnect

As of 2026-08-05, Threadlinqs Intelligence tracks 18 indicators of compromise for TL-2026-1896.

Sample indicators (3 of 18)

• IP address: 104.21.50[.]140
• Domain: coldcardcompliance[.]com
• File hash: 7ad243cd358d916e029ba8ff9a616dfdcab29b594a9ebf08a66a1c4bd63fb7e2

Defanged, TLP:CLEAR. Full set of 18 indicators: unlock with TL Creds.

How Coldcard audit phishing ScreenConnect works

On August 3, 2026, Proofpoint identified an active, highly sophisticated phishing campaign targeting Coldcard hardware wallet users. The campaign exploits the disclosure of a critical Coldcard firmware vulnerability (a March 2021 build error where a #ifndef guard caused the hardware wallet's RNG to silently fall back to MicroPython's deterministic Yasmarang pseudo-random generator instead of the STM32 hardware RNG, reducing seed entropy from 128 bits to as little as 40 bits on Mk2/Mk3 devices). This vulnerability has already resulted in the theft of at least 1,596 BTC (over $100 million) across three confirmed waves by at least 15 separate attackers, with a suspected fourth wave potentially bringing the total to ~2,055 BTC (~$130 million).

The phishing emails, spoofing compliance@coldcardteamnews.com with the subject line 'Hardware audit now available,' claim a coordinated security audit is underway across the Coldcard device network. Recipients are instructed to complete the 'Security Verification & Incident Reporting Tool' by a fabricated deadline of August 10, 2026. The email provides false assurances that the process is air-gapped and will not request recovery seeds, explicitly preying on fear of the recent vulnerability disclosure.

Clicking the call-to-action opens coldcardcompliance.com, a cloned Coldcard website registered on July 31, 2026 via Tucows Domains Inc. with registrant information in Saint Kitts and Nevis, hosted behind Cloudflare CDN (AS13335, IP 104.21.50.140). The site features a prominent 'Start Hardware Audit' button and a live 'Customer Service' chat that Proofpoint believes is staffed by real human operators rather than automated bots, enabling active social engineering to address victim concerns and pressure hesitant targets through the installation process.

Clicking 'Start Hardware Audit' downloads Coldcard_Diagnostic_Tool.bat (25.7 MB) hosted on a GitHub account. The batch file displays a diagnostic check GUI while executing its malicious payload in the background. It first checks for administrator privileges; if absent, it uses PowerShell to re-launch with UAC elevation (T1548.002). It then uses Windows certutil to decode two Base64-encoded files embedded within the script into a randomly named temporary directory: setup.msi (the actual ScreenConnect installer) and docusign.exe (a legitimate, signed DocuSign printer driver acting as a decoy). The setup.msi installs ConnectWise ScreenConnect silently (T1218.010), configured to connect to the attacker-controlled server at activeretirementrelocation.com. docusign.exe is launched simultaneously to mask anomalous behavior. After installation, the batch file displays an 'Installation Complete' message and deletes the temporary directory (T1070.004).

ScreenConnect, a legitimate Remote Monitoring and Management (RMM) tool, provides attackers with persistent remote access to the victim's system. Post-exploitation capabilities include data theft, cryptocurrency wallet compromise, additional malware deployment, and potentially ransomware (as warned by Proofpoint). The abuse of legitimate signed RMM software is an increasingly prevalent tactic that bypasses traditional EDR/AV detection, as the binary is inherently trusted.

The phishing campaign has prompted warnings from Trezor and Foundation — other hardware wallet manufacturers — who report their own users being targeted with similar lures. The same TTP cluster (ScreenConnect delivered via fake installer, certutil Base64 decoding, legitimate decoy execution) has been observed in related campaigns tracked by Securonix (SMOKE#SCREEN) and others, suggesting an active, well-resourced threat ecosystem targeting cryptocurrency holders.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1036.005 Match Legitimate Resource Name or Location; T1070.004 File Deletion; T1140 Deobfuscate/Decode Files or Information

Execution

T1059.001 PowerShell; T1059.003 Windows Command Shell; T1204.002 Malicious File

Command and Control

T1071.001 Web Protocols; T1572 Protocol Tunneling

stealth

T1218.010 Regsvr32

command-and-control

T1219 Remote Access Tools

Impact

T1496 Resource Hijacking

Persistence

T1543.003 Windows Service

Privilege Escalation

T1548.002 Bypass User Account Control

Initial Access

T1566.002 Spearphishing Link; T1566.003 Spearphishing via Service

Resource Development

T1583.001 Domains; T1587.001 Malware; T1588.002 Tool; T1608.006 SEO Poisoning

Reconnaissance

T1589.002 Email Addresses; T1598.003 Spearphishing Link

Remediation for Coldcard audit phishing ScreenConnect

Patches

• Coldcard Mk2/Mk3: update to firmware 4.2.0+
• Coldcard Mk4/Mk5: update to standard 5.6.0+ or Edge 6.6.0X+
• Coldcard Q: update to standard 1.5.0Q+ or Edge 6.6.0QX+
• CRITICAL: firmware update alone does NOT fix existing seeds — generate new seeds and migrate funds after update
• Users with seeds supplemented by 50+ fair, independent dice rolls are not affected by the RNG flaw

Immediate actions

• Block coldcardcompliance.com and activeretirementrelocation.com at perimeter DNS and web proxy
• Block email from coldcardteamnews.com domain
• Block IP 104.21.50.140 at network level (note: shared Cloudflare edge IP — monitor for collateral)
• Add detection rules for inbound emails referencing 'Coldcard hardware audit', 'coordinated audit', or 'Security Verification & Incident Reporting Tool'
• Warn all Coldcard wallet users not to respond to security audit emails — Coinkite never requests software installation

Workarounds

• Coldcard users with vulnerable firmware should not connect devices to networked computers until seeds are migrated
• Consider multisignature wallets with independent hardware from different manufacturers
• Use strong, unique BIP-39 passphrases for additional entropy (mitigates but does not eliminate RNG flaw risk)

Longer-term hardening

• Deploy EDR behavioral rules to detect ScreenConnect installation from non-enterprise administrative context
• Implement RMM tool allowlisting: permit only enterprise-managed ScreenConnect instances
• Monitor for certutil -decode usage not initiated by IT administration
• Track GitHub-hosted batch files as initial access vector in threat hunting workflows

Affected and fixed versions

• Coinkite — Coldcard Mk2
  Vulnerable versions: 4.0.1; 4.0.2; 4.0.3; 4.0.4; 4.0.5; 4.0.6; 4.0.7; 4.0.8; 4.0.9; 4.1.0
  Fixed in: 4.2.0+
• Coinkite — Coldcard Mk3
  Vulnerable versions: 4.0.1; 4.0.2; 4.0.3; 4.0.4; 4.0.5; 4.0.6; 4.0.7; 4.0.8; 4.0.9; 4.1.0
  Fixed in: 4.2.0+
• Coinkite — Coldcard Mk4
  Vulnerable versions: Before 5.6.0
  Fixed in: 5.6.0+ (standard); 6.6.0X+ (edge)
• Coinkite — Coldcard Mk5
  Vulnerable versions: Before 5.6.0
  Fixed in: 5.6.0+ (standard); 6.6.0X+ (edge)
• Coinkite — Coldcard Q
  Vulnerable versions: Before 1.5.0Q
  Fixed in: 1.5.0Q+ (standard); 6.6.0QX+ (edge)

Timeline of Coldcard audit phishing ScreenConnect

• 2021-03 Vulnerable Coldcard firmware build released — a #ifndef guard error causes RNG to silently fall back to MicroPython's deterministic Yasmarang PRNG instead of STM32 hardware RNG, affecting Mk2/Mk3 (firmware 4.0.1–4.1.9), Mk4/Mk5 (before 5.6.0), and Q devices (before 1.5.0Q)
• 2026-07-30 Block engineering team discloses the RNG flaw to Coinkite; first wave of automated Bitcoin theft begins same day — ~1,083 BTC ($70.2M) drained from 1,196 addresses in 41 minutes using 30 sat/vB fee with no change outputs; Chainalysis confirms attacker prioritized high-value wallets
• 2026-07-31 locked-ioc-7 registered via locked-ioc-10 (Saint Kitts and Nevis registrant), hosted behind locked-ioc-11 (AS13335, IP locked-ioc-12)
• 2026-08-01 Galaxy Research (Alex Thorn) identifies second and third attack waves — total confirmed theft reaches 1,367 BTC ($88.6M) from 4,585 addresses; additional 1,912 addresses holding 207.73 BTC remain unspent under attacker control
• 2026-08-01 Coinkite publicly discloses the RNG vulnerability, releases emergency firmware updates (4.2.0+ for Mk2/Mk3, 5.6.0+ for Mk4/Mk5, 1.5.0Q+ for Q); confirms that firmware update does not fix already-generated seeds — users must create new seeds and migrate funds
• 2026-08-03 locked-ioc-16 discovers and documents the Coldcard phishing campaign; shares findings via @threatinsight on X; identifies phishing emails from locked-ioc-3 with 'Hardware audit now available' subject line, cloned locked-ioc-7 site, and locked-ioc-13 RAT delivery
• 2026-08-04 Galaxy Research revises total to 1,596 BTC ($100M+) across 7,300 addresses with high confidence; suspects fourth wave may bring total to ~2,055 BTC (~$130M); identifies at least 15 separate attackers exploiting the RNG flaw; Trezor and Foundation issue user warnings about the phishing surge
• 2026-08-05 BleepingComputer publishes detailed article on the Coldcard security audit phishing campaign; campaign remains active; phishing emails set deadline of August 10, 2026

Sources cited for Coldcard audit phishing ScreenConnect

• Galaxy Research — Coldcard Theft Analysis (Alex Thorn) x.com · Research · 2026-08-03
• Coinkite — Official Coldcard RNG Vulnerability Advisory coldcard.com · Vendor report · 2026-08-01
• Proofpoint ThreatInsight — Coldcard Phishing Disclosure x.com · Research · 2026-08-03
• Block Engineering — Predictable RNG Fallback Analysis block.xyz · Research · 2026-07-30
• SMOKE#SCREEN: ScreenConnect RMM Abuse Analysis — Securonix securonix.com · Research · 2026-03-15
• COLDCARD security audit phishing attack installs remote access tool BleepingComputer · News · 2026-08-05
• Coldcard Wallet RNG Flaw Likely Linked to $88 Million Bitcoin Theft BleepingComputer · News · 2026-08-02
• Hardware Wallet Firms Warn of Phishing Surge as Coldcard Losses Near $130M decrypt.co · News · 2026-08-04
• Coldcard Bitcoin Exploit Explained: Entropy, Keys, and Bits decrypt.co · News · 2026-08-04
• Coldcard Exploit Tops $100M as Phishing Spreads coin360.com · News · 2026-08-04

Threats related to Coldcard audit phishing ScreenConnect

• TRUSTMARKET Phishing Campaign Expands to Chileautos and New International Platforms
• Formula 1 Phishing Campaign & Kit Analysis: Real-Time BIN-Routed Ticketing Fraud Kit Targets Middle East Banking Customers (SOCRadar STRU)
• Phishing Campaign Impersonates LastPass and Bitwarden Security Alerts to Deliver Fake DocuSign Pages
• AiTM Phishing Becomes Top Initial Access Vector for Law Firms: Tycoon2FA, ClickFix/NetSupport RAT, Teams Vishing (STAC4749), and Lumma Stealer Converge on the Legal Sector