Fake "coordinated hardware audit" emails are steering holders to a cloned Coldcard site that installs remote-access software.