Phishing Campaign Impersonating COLDCARD Security Audit Deploys Remote Access Tool
What Happened — Attackers sent phishing emails that pretended to be a “hardware audit” for COLDCARD cold‑storage wallets. The messages directed recipients to a fake site (coldcardcompliance.com) which delivered a batch file that installed the ScreenConnect remote‑access tool on the victim’s machine.
Why It Matters for Compliance & Audit Readiness
- This is a textbook example of a social‑engineering breach that SOC 2 access‑control criteria (CC6.1, CC6.2) are designed to mitigate through documented policies, least‑privilege provisioning, and periodic user‑awareness testing.
- A successful phishing‑driven remote‑access compromise creates audit‑evidence gaps (e.g., missing logs of privileged sessions) that continuous‑control monitoring must capture to remain SOC 2‑ready.
Who Is Affected — Cryptocurrency users, hardware‑wallet enthusiasts, and any organization that stores private keys on COLDCARD devices; primarily the financial‑services and crypto‑asset sectors.
Recommended Actions
- Verify that all inbound email filtering rules block spoofed “@coldcardteamnews.com” domains and that DMARC/DKIM alignment is enforced.
- Map the incident to SOC 2 CC6 controls, collect evidence of phishing‑simulation results, and update your security‑awareness training program to include wallet‑specific phishing scenarios.
- Ensure remote‑access tools (e.g., ScreenConnect) are inventoried, approved, and logged; enable MFA for any privileged remote sessions.
Technical Notes — The phishing lure leveraged the recent COLDCARD RNG flaw (CVE‑2025‑XXXX) to add urgency. The malicious batch file (Coldcard_Diagnostic_Tool.bat) contained two Base64‑encoded payloads that, when executed, installed ScreenConnect and opened a reverse RDP tunnel. Source: BleepingComputer