# Coldcard Security Audit Phishing Campaign Installs ConnectWise ScreenConnect RAT

> Active phishing campaign impersonating Coldcard hardware wallet security audit delivers ConnectWise ScreenConnect remote access tool. Emails from compliance@coldcardteamnews.com direct victims to cloned website coldcardcompliance.com, which downloads Coldcard_Diagnostic_Tool.bat that silently installs ScreenConnect RAT, granting attackers full remote control. The campaign exploits a recently disclosed Coldcard firmware RNG vulnerability that has already led to ~$100M+ in Bitcoin theft across multiple attack waves by at least 15 separate attackers.

- **Published:** 2026-08-05T00:00:00Z
- **Last reviewed:** 2026-08-05T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1896
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-coldcard-audit-phishing-screenconnect-tl-2026-1896.webp?v=dd416626 (Threadlinqs threat intel: Coldcard Audit Phishing ScreenConnect: Detection & IOCs (TL-2026-1896) — Critical severity, 18 IOCs, 9 detection rules.)
- **ID:** TL-2026-1896
- **Severity:** CRITICAL
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 18 (3 shown free below)

## Description

On August 3, 2026, Proofpoint identified an active, highly sophisticated phishing campaign targeting Coldcard hardware wallet users. The campaign exploits the disclosure of a critical Coldcard firmware vulnerability (a March 2021 build error where a #ifndef guard caused the hardware wallet's RNG to silently fall back to MicroPython's deterministic Yasmarang pseudo-random generator instead of the STM32 hardware RNG, reducing seed entropy from 128 bits to as little as 40 bits on Mk2/Mk3 devices). This vulnerability has already resulted in the theft of at least 1,596 BTC (over $100 million) across three confirmed waves by at least 15 separate attackers, with a suspected fourth wave potentially bringing the total to ~2,055 BTC (~$130 million).

The phishing emails, spoofing compliance@coldcardteamnews.com with the subject line 'Hardware audit now available,' claim a coordinated security audit is underway across the Coldcard device network. Recipients are instructed to complete the 'Security Verification & Incident Reporting Tool' by a fabricated deadline of August 10, 2026. The email provides false assurances that the process is air-gapped and will not request recovery seeds, explicitly preying on fear of the recent vulnerability disclosure.

Clicking the call-to-action opens coldcardcompliance.com, a cloned Coldcard website registered on July 31, 2026 via Tucows Domains Inc. with registrant information in Saint Kitts and Nevis, hosted behind Cloudflare CDN (AS13335, IP 104.21.50.140). The site features a prominent 'Start Hardware Audit' button and a live 'Customer Service' chat that Proofpoint believes is staffed by real human operators rather than automated bots, enabling active social engineering to address victim concerns and pressure hesitant targets through the installation process.

Clicking 'Start Hardware Audit' downloads Coldcard_Diagnostic_Tool.bat (25.7 MB) hosted on a GitHub account. The batch file displays a diagnostic check GUI while executing its malicious payload in the background. It first checks for administrator privileges; if absent, it uses PowerShell to re-launch with UAC elevation (T1548.002). It then uses Windows certutil to decode two Base64-encoded files embedded within the script into a randomly named temporary directory: setup.msi (the actual ScreenConnect installer) and docusign.exe (a legitimate, signed DocuSign printer driver acting as a decoy). The setup.msi installs ConnectWise ScreenConnect silently (T1218.010), configured to connect to the attacker-controlled server at activeretirementrelocation.com. docusign.exe is launched simultaneously to mask anomalous behavior. After installation, the batch file displays an 'Installation Complete' message and deletes the temporary directory (T1070.004).

ScreenConnect, a legitimate Remote Monitoring and Management (RMM) tool, provides attackers with persistent remote access to the victim's system. Post-exploitation capabilities include data theft, cryptocurrency wallet compromise, additional malware deployment, and potentially ransomware (as warned by Proofpoint). The abuse of legitimate signed RMM software is an increasingly prevalent tactic that bypasses traditional EDR/AV detection, as the binary is inherently trusted.

The phishing campaign has prompted warnings from Trezor and Foundation — other hardware wallet manufacturers — who report their own users being targeted with similar lures. The same TTP cluster (ScreenConnect delivered via fake installer, certutil Base64 decoding, legitimate decoy execution) has been observed in related campaigns tracked by Securonix (SMOKE#SCREEN) and others, suggesting an active, well-resourced threat ecosystem targeting cryptocurrency holders.

## MITRE ATT&CK

- T1589.002 Email Addresses
- T1598.003 Spearphishing Link
- T1583.001 Domains
- T1587.001 Malware
- T1588.002 Tool
- T1608.006 SEO Poisoning
- T1566.002 Spearphishing Link
- T1566.003 Spearphishing via Service
- T1204.002 Malicious File
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1218.010 Regsvr32
- T1543.003 Windows Service
- T1219 Remote Access Tools
- T1548.002 Bypass User Account Control
- T1140 Deobfuscate/Decode Files or Information
- T1036.005 Match Legitimate Resource Name or Location
- T1070.004 File Deletion
- T1071.001 Web Protocols
- T1572 Protocol Tunneling
- T1496 Resource Hijacking

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Certutil-Decode Followed by MSIExec ScreenConnect Install — Post-Exploitation Phase** (`TL-2026-1896-SPL-002`)

Detects the core post-exploitation chain: Windows certutil.exe used to decode Base64-embedded payloads from a batch file into a temp directory, followed by MSIExec silently installing an MSI (ScreenConnect RAT). Tracks the sequence of cmd.exe spawning certutil -decode then msiexec /i /quiet within a short window — the signature of the Coldcard_Diagnostic_Tool.bat payload execution.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1059.003, T1059.001, T1140, T1218.010, T1548.002, T1070.004
- **Data sources:** sysmon_process_creation, windows_security_event_4688, device_process_events
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (ParentImage="*\\cmd.exe" OR ParentImage="*\\powershell.exe")
  (Image="*\\certutil.exe" OR Image="*\\msiexec.exe")
  (CommandLine="*-decode*" OR CommandLine="*/i*" CommandLine="*/quiet*")
| stats dc(Image) as unique_images, values(CommandLine) as cmds, min(_time) as first_seen, max(_time) as last_seen by ParentImage, ComputerName, ProcessGuid
| where unique_images >= 2
| eval chain_detected=if(mvcount(cmds)>=2 AND match(cmds,"(?i)certutil.*-decode") AND match(cmds,"(?i)msiexec.*/i.*/quiet"),"certutil_decode_to_msiexec","partial")
| where chain_detected="certutil_decode_to_msiexec"
| eval threat_id="TL-2026-1896"
| table _time, ComputerName, ParentImage, cmds, chain_detected, threat_id
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("cmd.exe", "powershell.exe")
| where FileName in~ ("certutil.exe", "msiexec.exe")
| where ProcessCommandLine has_any ("-decode", "/i", "/quiet")
| summarize
    ProcessesMade=makelist(FileName),
    CommandLines=makelist(ProcessCommandLine),
    FirstSeen=min(Timestamp),
    LastSeen=max(Timestamp)
    by DeviceName, InitiatingProcessFileName, InitiatingProcessId
| where ProcessesMade has_all ("certutil.exe", "msiexec.exe")
| extend
    HasCertutilDecode = iff(CommandLines has_any ("-decode"), true, false),
    HasMsiSilentInstall = iff(CommandLines has_any ("/i") and CommandLines has_any ("/quiet"), true, false)
| where HasCertutilDecode and HasMsiSilentInstall
| project-reorder DeviceName, InitiatingProcessFileName, ProcessesMade, CommandLines, FirstSeen, LastSeen
```

### Sigma

```yaml
title: Certutil Decode Followed by MSIExec Silent Install — ScreenConnect RAT Deployment
id: b7d1e8f4-63c2-4a09-a1f9-3e7bc52a9d04
status: experimental
description: Detects the chain of certutil.exe used to decode Base64-encoded payload followed by msiexec.exe silently installing an MSI within a short window. This is the core delivery mechanism of the Coldcard_Diagnostic_Tool.bat ScreenConnect RAT deployment.
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-05
references:
  - https://www.bleepingcomputer.com/news/security/coldcard-security-audit-phishing-attack-installs-remote-access-tool/
  - https://www.securonix.com/blog/smoke-screen-screenconnect-rmm-abuse-cloudflare-tunnels/
tags:
  - attack.execution
  - attack.t1059.003
  - attack.t1059.001
  - attack.t1548.002
  - attack.defense_evasion
  - attack.t1140
  - attack.t1218.010
  - attack.t1070.004
  - attack.tool.certutil
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\\cmd.exe'
      - '\\powershell.exe'
  selection_certutil:
    Image|endswith: '\\certutil.exe'
    CommandLine|contains: '-decode'
  selection_msiexec:
    Image|endswith: '\\msiexec.exe'
    CommandLine|contains|all:
      - '/i'
      - '/quiet'
  condition: selection_parent and (selection_certutil and selection_msiexec) | near timeframe: 60s
falsepositives:
  - IT administrative scripts that legitimately use certutil -decode followed by MSI installation (rare; typically uses different deployment tools like PDQ, SCCM, or Group Policy)
  - Software deployment via enterprise tools that may chain msiexec after a download script
level: critical
```

**Known false positives:**

- IT admin scripts using certutil for legitimate file decoding followed by MSI installation — rare; typical enterprise deployment uses SCCM, PDQ, or GPO rather than cmd.exe chains

**Tuning notes:** Increase fidelity by requiring certutil -decode to write to a non-standard temp path (e.g., %TEMP%\random_name\). Exclude known IT admin scripts via parent process allowlist (e.g., SCCM client, PDQ). Set correlation window to 60 seconds. Add additional signal if certutil input file is a .bat or .cmd file.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Coldcard Phishing Chain — Email to Suspicious File Download — Exploitation Phase (locked: unlock with TL Creds)
- Batch File Execution Chain — Cmd to PowerShell UAC Bypass to Certutil Decode to MSIExec — Post-Exploitation Phase (locked: unlock with TL Creds)
- Non-Enterprise ScreenConnect Service Installation and C2 Beaconing — C2 Phase (locked: unlock with TL Creds)
- Coldcard Cloned Website and Phishing Payload Download — Exploitation Phase (locked: unlock with TL Creds)
- ScreenConnect RAT Installation via MSIExec With Decoy Process — Post-Exploitation Phase (locked: unlock with TL Creds)
- ScreenConnect Service Persistence and Suspicious C2 Relay Communication — C2 Phase (locked: unlock with TL Creds)
- Coldcard Phishing Email With ScreenConnect Payload Link — Exploitation Phase (locked: unlock with TL Creds)
- ScreenConnect Outbound C2 Connection to Suspicious Domain — C2 Phase (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 18)

Defanged, TLP:CLEAR.

- IP address: `104.21.50[.]140`
- Domain: `coldcardcompliance[.]com`
- File hash: `7ad243cd358d916e029ba8ff9a616dfdcab29b594a9ebf08a66a1c4bd63fb7e2`

Full set of 18 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [COLDCARD security audit phishing attack installs remote access tool](https://www.bleepingcomputer.com/news/security/coldcard-security-audit-phishing-attack-installs-remote-access-tool/)
- [Coldcard Wallet RNG Flaw Likely Linked to $88 Million Bitcoin Theft](https://www.bleepingcomputer.com/news/security/coldcard-wallet-rng-flaw-likely-linked-to-88-million-bitcoin-theft/)
- [Hardware Wallet Firms Warn of Phishing Surge as Coldcard Losses Near $130M](https://decrypt.co/374891/hardware-wallet-firms-warn-of-phishing-surge-as-coldcard-losses-near-130m)
- [Coldcard Bitcoin Exploit Explained: Entropy, Keys, and Bits](https://decrypt.co/374916/coldcard-bitcoin-exploit-explained-entropy-keys-bits)
- [Coldcard Exploit Tops $100M as Phishing Spreads](https://coin360.com/news/coldcard-exploit-phishing-bitcoin-wallets)
- [Galaxy Research — Coldcard Theft Analysis (Alex Thorn)](https://x.com/alexthorn_)
- [Coinkite — Official Coldcard RNG Vulnerability Advisory](https://coldcard.com/docs/advisory-rng)
- [Proofpoint ThreatInsight — Coldcard Phishing Disclosure](https://x.com/threatinsight)
- [Block Engineering — Predictable RNG Fallback Analysis](https://block.xyz/engineering/research/coldcard-rng)
- [SMOKE#SCREEN: ScreenConnect RMM Abuse Analysis — Securonix](https://www.securonix.com/blog/smoke-screen-screenconnect-rmm-abuse-cloudflare-tunnels/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1896