A Human-Powered Phishing Campaign Exploits Coldcard Wallet Fears to Install Remote Access Tools
The Coldcard hardware wallet just had its RNG vulnerability exposed, and hackers didn't waste a second. They stole roughly 1,367 Bitcoin — about $88.6 million from 4,585 addresses — and then immediately turned around and sold the panic. That's the setup for a new phishing campaign discovered by Proofpoint, and it's one of those attacks where the human element matters more than the code. Real people are manning chat windows, pressuring victims, and guiding them through installation steps. It's old-school social engineering wearing a shiny new coat of crypto anxiety.
How AI Cybersecurity Threats Manifest in Wallet Phishing
When we talk about AI cybersecurity threats in 2026, we usually picture deepfake voice calls, automated credential stuffing, or AI-generated spear-phishing at scale. But this Coldcard campaign is different. It's deliberately low-tech on the surface — a batch file, a fake compliance portal, a live chat operator — because that's exactly what works. The attackers aren't trying to out-innovate your endpoint detection. They're counting on the fact that wallet holders are scared, confused, and looking for answers.
What is AI in cyber security, really, when it comes to campaigns like this? It's not just about automated bots. It's about how threat actors leverage the gap between rapid technological change and human trust. The RNG flaw in Coldcard devices hit hard because it affected multiple models and firmware versions simultaneously. That kind of vulnerability creates a ripple of uncertainty, and uncertainty is where phishing thrives.
The campaign exploits exactly that uncertainty. The attackers know wallet users are worried about their funds. They know the word "audit" sounds official. They know people will click. And they're right.
The Email That Starts It All
The campaign kicks off with an email sent from [email protected] — a domain designed to look legitimate but isn't. The subject line reads "Hardware audit now available," and the body claims that "recent findings require COLDCARD to verify the integrity of devices across all hardware revisions." The language is bureaucratic enough to sound plausible, urgent enough to provoke action, and vague enough to avoid raising immediate red flags.
The email directs recipients to coldcardcompliance.com, a site that impersonates the real Coldcard brand. It tells users to click "Start Hardware Audit" and download a "Security Verification & Incident Reporting Tool." The site claims the process is air-gapped and won't request recovery seeds — reassuring language designed to lower defenses. It also sets an arbitrary deadline: August 10. Deadlines create pressure. Pressure creates mistakes.
The Fake Compliance Portal and Live Chat Operators
Here's where the campaign gets interesting. The fake website includes a live "Customer Service" chat feature. This isn't a chatbot. Proofpoint's analysis suggests real humans are operating these chats, asking whether the victim uses Windows or macOS, and then walking them through the installation step by step.
One victim reported seeing a black window and an administrator prompt. The chat operator explained that the prompt was required to begin the installation and told them to click "Yes." This is the kind of hands-on support that automated phishing tools simply can't replicate. It's the difference between a script and a scammer sitting at a keyboard, reading your responses and adjusting in real time.
The Batch File That Does the Damage
Clicking "Start Hardware Audit" on the fake site downloads a batch file named Coldcard_Diagnostic_Tool.bat from a GitHub account. BleepingComputer's analysis of this 25.7MB file reveals something clever. The batch file contains two Base64-encoded files embedded directly in its code: setup.msi and docusign.exe.
When launched, the script pretends to perform a diagnostic check on your device. In the background, it checks whether the user has administrator privileges. If not, it uses PowerShell to relaunch itself with a User Account Control prompt requesting elevated permissions. Once admin rights are secured, the script stores the embedded files in a randomly named directory within the Windows temp folder and decodes them using Windows certutil.
The Decoy and the Real Payload
The setup.msi file is actually a ConnectWise ScreenConnect installer — a legitimate remote management tool that threat actors repurpose for malicious access. The docusign.exe file is a legitimate signed executable that installs a DocuSign printer driver, serving as a decoy. If a victim or analyst notices the DocuSign installation, they might not immediately connect it to the real threat.
After installing ScreenConnect, the script launches docusign.exe, displays an "Installation Complete" message, and deletes the temporary directory. Clean. Efficient. Designed to leave minimal traces.
Command and Control: Where the Damage Happens
Once ScreenConnect is installed, the victim's computer connects to activeretirementrelocation.com, which serves as the ScreenConnect command-and-control server controlled by the threat actor. From here, attackers have full remote access to the device. They can steal data, siphon cryptocurrency, or install additional malware including ransomware. Proofpoint warns that this level of access could be used to deploy ransomware at the attacker's discretion.
What This Means for AI Cybersecurity Threats in 2026
This campaign is a case study in how ai cybersecurity threats evolve. It's not about sophisticated AI-generated content or autonomous exploit frameworks. It's about psychological manipulation amplified by genuine security concerns. The attackers didn't need to build new malware from scratch. They repurposed legitimate software (ScreenConnect, DocuSign) and wrapped it in a phishing narrative that preyed on real fear.
What is AI in cyber security when human-driven campaigns like this keep succeeding? It's the recognition that technology alone can't solve the problem. Defenders need to understand that attackers will always exploit the gap between technical complexity and human understanding. The Coldcard RNG flaw was a technical vulnerability. The phishing campaign is a psychological one. Both are real. Both are dangerous.
How to Protect Yourself
The first line of defense is skepticism. If you receive an email claiming to be from a hardware wallet provider about a "security audit," verify it through official channels before clicking anything. Legitimate companies don't send urgent emails with arbitrary deadlines demanding immediate action. They send official communications through verified channels.
Second, be wary of any tool that requests administrator privileges. Legitimate security tools might, but they rarely do so through a web download triggered by an email. If something feels off, it probably is.
Third, keep your ScreenConnect and remote access tools updated and monitored. If you're managing devices that use legitimate remote management software, ensure that connections to unexpected C2 servers like activeretirementrelocation.com are blocked and investigated.
Finally, stay informed about vulnerabilities affecting your hardware. The Coldcard RNG flaw affected multiple models and firmware versions. Knowing what's vulnerable helps you recognize when a phishing campaign is trying to exploit that knowledge.
The Bigger Picture
The Coldcard phishing campaign isn't an isolated incident. It's a symptom of a broader trend: attackers are becoming more sophisticated not just in their technical capabilities, but in their understanding of human psychology. They know when to push, when to wait, and when to use a live chat operator to grease the wheels.
As AI continues to reshape the cybersecurity landscape, campaigns like this remind us that the weakest link is still the human on the other end of the screen. Technology can build firewalls, detect anomalies, and flag suspicious URLs. But it can't replace vigilance. It can't replace the instinct to pause, question, and verify.
The $88.6 million stolen through the Coldcard RNG flaw was just the beginning. The phishing campaign that followed is a reminder that in cybersecurity, the attack doesn't stop when the vulnerability is patched. It evolves.
Source: BleepingComputer
