COLDCARD phishing lure deploys ScreenConnect RAT on victims

Thu, 06 Aug 2026 13:03:19 +0000

Engineer — Skip
SOC/IR — Act: A phishing campaign is actively distributing ScreenConnect as a RAT using COLDCARD vulnerability lures; hunt for unexpected ScreenConnect installations on endpoints and tune EDR detections for ScreenConnect deployed outside approved baselines.
Leader — Learn: This campaign illustrates how high-profile crypto incidents are rapidly weaponized as phishing lures; useful context for security awareness briefings but no immediate organizational action required.

Remote-Access-Trojan on CuraSec