A remote support tool does not need to crack your machine when you have already installed it, approved it, and taught the firewall to trust it. Attackers are exploiting that access across dozens of countries. The software is legitimate and the connection looks routine. The person moving the mouse may be the only malicious component. For a Bitcoiner, that puts the laptop around a hardware wallet inside the custody boundary, even when the seed never leaves the signer. Remote help should expire when the support session ends.
The trusted tool is the payload
ANY(dot)RUN disclosed a remote-access campaign on August 25 that spanned 46 countries. Its researchers linked 601 observed cases to a reusable phishing kit that impersonated tax authorities, Social Security, Adobe, invoices, and shipping notices. The lure delivered legitimate, signed products such as GoTo Resolve, LogMeIn Rescue, ITarian, ScreenConnect, and ConnectWise. Ordinary signature-based antivirus had little to object to because the software did exactly what its vendor built it to do.
This was no one-off trick. Huntress says abuse of remote monitoring and management software rose 277% last year and now appears in nearly 40% of the incidents its tactical response team investigates. In one case, a rogue ScreenConnect install sat unused for five months. An attacker later returned, entered the victim's browser, created inbox rules, and sent more remote-access lures from a legitimate account.
Expel published a second current mechanism on August 20. An attacker posing as an IT help desk in Microsoft Teams persuaded a target to install a fake PowerShell cleaner from Microsoft Azure storage. SynkLoader produced a fake Windows lock screen, captured a password, opened a reverse proxy, and delivered remote shell and VNC control. The installer appeared to offer help. It handed over the machine.
Your signer cannot clean the coordinator
A hardware wallet protects private keys and signs what it receives. It cannot make the laptop proposing the transaction honest. Sparrow Wallet's documentation draws the boundary clearly: keys remain inside the hardware device, while the computer sends transactions for the device to sign and receives the signatures.
A remote operator on that computer may see wallet balances, labels, output descriptors, public keys, exchange sessions, email, address books, and draft PSBTs. They may alter a destination or amount before the transaction reaches the signer. Theft is not automatic. A careful operator can catch the change by reviewing the destination, amount, fee, and change directly on the hardware screen. COLDCARD's current signing guidance (notwithstanding their recent hack) tells users not to sign any PSBT containing an unrecognized detail and warns about fraudulent change addresses.
That boundary changes the response. An air-gapped seed does nothing to stop an attacker from watching the coordinator, operating its browser, stealing its sessions, or shaping the transaction presented for approval. The signer protects authority. The workstation still exposes intent and identity, plus the timing and content of a proposed transaction.
Run a ten-minute remote-access audit
Do this on every machine that holds a wallet coordinator, node credentials, exchange access, signing instructions, or sensitive Bitcoin records.
1. Inventory installed tools. Check applications, login items, startup tasks, services, browser extensions, and portable executables. Compare unfamiliar names with LOLRMM, a current catalog of 317 remote-management and remote-access tools.
2. Check built-in access. On Windows, inspect Remote Desktop and Quick Assist. On macOS, open System Settings, General, Sharing, then inspect Screen Sharing and Remote Management. Apple confirms that screen sharing lets another computer view the desktop, control apps and files, and restart the Mac.
3. Give every surviving tool an owner. Record who installed it, why it exists, which account can use it, and when that need expires. An unknown remote-access agent is evidence of an incident.
4. Remove anything with no current purpose. Uninstall the application, disable its service, revoke its account or device registration, and reboot. Repeat the inventory because attackers often install a second tool as a fallback.
5. Inspect recent evidence. Review remote-session history, new services, scheduled tasks, login items, browser downloads, and account alerts. CISA's ransomware guidance recommends auditing authorized RMM software and reviewing execution logs for abnormal or portable use.
6. Create a clean boundary. A machine that coordinates meaningful Bitcoin transactions should never double as the family help-desk box, a contractor support endpoint, or an always-on remote administration target.
Make support temporary
Some people genuinely need remote assistance. The safer version begins closed. Open it for one named session while you are present, after verifying the helper's identity through a known channel.
Close Sparrow, password managers, email, exchanges, cloud drives, terminals, and sensitive documents before the session. Leave the signer disconnected and locked.
Initiate the request yourself. Never trust an inbound caller, Teams message, search ad, or email that supplies both the problem and the remote-control cure.
Start with view-only access. Stop if the helper requests elevation or persistence, asks for security-tool changes, or wants a reboot that preserves access.
Never display a seed, load a PSBT, approve an address, or sign a message or transaction while another person can see or control the screen.
End the session, revoke the code, and remove the tool if its job is finished. Inspect startup and service entries, then reboot and check again.
Convenience has a habit of becoming infrastructure. If a support agent says the software must remain installed for future maintenance, move that maintenance to a machine outside the Bitcoin trust boundary.
The PSBT support-session trap
Leila runs Sparrow on a dedicated laptop and signs with an air-gapped COLDCARD. Months earlier, a consultant installed ScreenConnect to fix a printer problem. The application still starts with the machine, but Leila has forgotten it exists.
An attacker later gains control of the old support account and waits until Sparrow is open. The attacker sees wallet labels, learns which outputs matter, and replaces the destination in a large PSBT. Leila compares the address and amount on the COLDCARD screen with the recipient details she verified through a separate channel. The mismatch stops the payment.
Her signer worked, but her setup exposed far too much. The attacker learned her wallet structure, timing, contacts, and likely balance. The coordinator can no longer be trusted. Leila disconnects it, moves account recovery and password changes to a clean device, preserves the signer, and rebuilds the coordinator from known-good media. She never types the seed into the compromised laptop or panic-signs a sweep proposed by it.
If the cursor moves without you
Disconnect the machine from the network first. Do not use that computer to change passwords, contact support, or prepare a rescue transaction. From a known-clean device, revoke remote-access registrations, browser and email sessions, API tokens, SSH keys, and any other credentials the machine could expose. Review account activity. Preserve logs or screenshots if you can do so without reconnecting the suspect host.
After confirmed unauthorized access, removing the visible remote tool leaves too much uncertainty. Rebuild the operating system or replace the coordinator, then restore only verified data. If a seed or private key ever appeared on the compromised machine, treat it as exposed and migrate funds through a clean workflow. If the seed stayed inside a hardware signer, keep that distinction intact. Investigate and rebuild before moving funds, then verify any necessary transaction on the device against details obtained through a separate trusted channel.
Final thoughts
Remote-access software collapses the distance that self-custody depends on. Its logo, signature, and familiar vendor domain reveal nothing about who controls the other end. Review every transaction on the signer's own screen. Deny standing access to the coordinator. Support needs a purpose and an expiry. Visitors have no place on a Bitcoin workstation.
