Phishing Campaign Poses as COLDCARD Security Audit to Install Remote Access Tool

·13 views

A phishing campaign discovered by Proofpoint targeted COLDCARD hardware wallet users with fake security audit emails sent from a spoofed domain, exploiting recent news about the wallet's random number vulnerabilities and an $88.6 million Bitcoin theft. Victims were directed to a fraudulent compliance website and guided by a live chat operator to download a 25.7MB batch file named Coldcard_Diagnostic_Tool.bat from an attacker-controlled GitHub account. The file silently decoded and installed a ConnectWise ScreenConnect remote access client using certutil and PowerShell, while displaying a decoy DocuSign printer driver screen to mask the infection. Once installed, ScreenConnect connected to an attacker-controlled server, granting full remote access to the victim's Windows device. The campaign was designed to bypass suspicion by assuring users that no recovery seed phrases were required, and live chat agents coached victims through UAC elevation prompts in real time.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

AI Model Landscape 2026: Claude, GPT-5.4, and Gemini Lead the Pack

As of 2026, the frontier AI model competition is dominated by three players: Anthropic's Claude Sonnet 4.6, OpenAI's GPT-5.4, and Google's Gemini 3.1 Pro, each offering 1M token context windows and distinct strengths. GPT-5.4, released in March 2026, introduced native computer use and desktop interface operation, while Gemini 3.1 Pro, released in February 2026, scores 77.1% on the ARC-AGI-2 reasoning benchmark and integrates deeply with Google's ecosystem. OpenAI also maintains a separate Codex family optimized for agentic software engineering tasks. Experts caution that benchmark rankings shift rapidly and that the practical performance gap between models in everyday use is narrower than leaderboards imply. Ultimately, the developer tooling and workflow integration surrounding a model can matter more than the model's raw benchmark performance.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Ghidra Can Be Adapted to Reverse Engineer Unknown Binary Architectures

Ghidra, the open-source reverse engineering tool, relies on specification files like .slaspec and .sla to define processor instruction sets and decode binaries. When analyzing a binary built for an undocumented or unknown processor, these specification files are absent, causing Ghidra to render unreadable output and produce corrupted disassembly. To address this, engineers must shift Ghidra from its default aggressive disassembly mode to a conservative, opportunistic approach that only decodes bytes where explicitly permitted. This prevents cascading errors in control flow graphs and register tracking by isolating only verified execution blocks. Ghidra's modular Java-based architecture allows analysts to disable automatic analyzers and construct minimal custom SLEIGH modules to gradually reconstruct the unknown instruction set.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How eCommerce Engineering Breaks Down After 1,000 Orders

As online stores scale from a handful of orders to thousands, infrastructure and operational challenges shift from minor inconveniences to systemic problems. At low volumes, manual fixes for errors like incorrect order statuses or outdated product data are manageable, but temporary workarounds tend to become permanent fixtures. Once order volume reaches the hundreds, low-frequency errors begin recurring regularly, forcing teams to choose between repeatedly patching symptoms or addressing root causes. By the time a store processes around 1,000 orders, small inefficiencies—such as a two-minute manual check—compound into hours of lost time and expose architectural weaknesses. The engineering team behind Droplox, an eCommerce platform, shared these observations to highlight how growth that appears as a single rising number actually represents fundamentally different operating conditions at each stage.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Vue 3 and pdf-lib Can Power a Browser-Based PDF Repair Tool

A browser-based PDF repair tool can be built using Vue 3, the Composition API, and the pdf-lib library to recover content from structurally corrupted files. The approach works because PDF page content streams are often intact even when structural elements like cross-reference tables or trailer objects are damaged. The tool attempts to copy each page individually into a new PDF document, skipping any unreadable pages rather than aborting the entire process. Key implementation details include setting the ignoreEncryption and updateMetadata flags to false during loading, reducing the risk of early failures on files with corrupted metadata or encryption dictionaries. Partial recovery — such as salvaging five of ten pages — is treated as a meaningful success, and the UI is designed to clearly communicate how many pages were retrieved.

0 comments Read more at DEV Community