Brinztech Alert: Cryptocurrency Users Targeted Via Typosquatted Coldcard Domain Distributing Malicious Screenconnect Rmm Installers

Brinztech https://brinztech.com/breach-alerts/

Dark Web News & Incident Analysis

Security researchers have flagged an active cybercriminal campaign specifically designed to target and compromise cryptocurrency users. The operation relies on sophisticated social engineering, beginning with a fraudulent, typosquatted domain engineered to mimic the official website of popular Bitcoin hardware wallet manufacturer Coldcard.

When unsuspecting users land on the rogue infrastructure, they are redirected to an external GitHub repository hosting a malicious Microsoft Installer (MSI) package disguised as a legitimate DocuSign document-signing application. Upon execution, the payload bypasses initial suspicion and silently deploys ScreenConnect—a legitimate Remote Monitoring and Management (RMM) software package heavily abused by threat actors to establish persistent, unattended remote access. By taking control of the victim’s endpoint, the attackers position themselves to harvest local cryptocurrency wallet seed phrases, browser-stored private keys, and administrative credentials.

Key Cybersecurity Insights

The integration of trusted software brands and legitimate RMM tools highlights evolving tactics in modern crypto-targeted malware campaigns:

• Abuse of Legitimate RMM Platforms: Threat actors increasingly favor legitimate remote administration tools like ScreenConnect, AnyDesk, or TeamViewer because their network traffic frequently blends in with normal administrative operations, evading standard signature-based blocks.
• Leveraging Reputable Hosting Services: By staging secondary payloads on GitHub repositories, attackers exploit the inherent trust users place in established developer platforms to bypass perimeter security filters.
• Typosquatting High-Value Targets: Cryptocurrency hardware wallet ecosystems remain prime targets for sophisticated phishing and watering-hole operations due to the irreversible nature of digital asset theft.

Mitigation Strategies

Cryptocurrency holders, enterprise security teams, and individual users must maintain strict verification protocols:

• Verify Official Domains Rigorously: Always double-check URLs and bookmark official service providers (such as Coldcard) directly, avoiding search engine ads or unverified links.
• Audit RMM Software Installations: Configure Endpoint Detection and Response (EDR) solutions to flag, alert, or block the unauthorized installation or execution of remote management and monitoring agents like ScreenConnect.
• Exercise Caution with Third-Party Downloads: Never execute software or installers downloaded from external repositories or links provided via unsolicited messages, even if they claim to be standard corporate utilities like DocuSign.

Secure Your Organization with Brinztech As a cybersecurity provider, we can protect your business from the threats discussed here. Contact us to learn more about our services.

Questions or Feedback? For expert advice, use our ‘Ask an Analyst’ feature. Brinztech does not warrant the validity of external claims. For general inquiries or to report this post, please email us: contact@brinztech.com

The post Brinztech Alert: Cryptocurrency Users Targeted via Typosquatted Coldcard Domain Distributing Malicious ScreenConnect RMM Installers first appeared on Brinztech.