Cryptocurrency Wallets Security Review: OkoBot Malware Framework Analysis
In short
Kaspersky identified the OkoBot framework in January 2026 as a modular tool stealing cryptocurrency wallet data across 25 countries through ClickFix tactics and fake GitHub repositories.
Kaspersky GReAT researchers first detected the OkoBot malware framework in January 2026 while examining attacks that captured cryptocurrency wallet window contents. The framework evolved from the TookPS campaign that began in March or April 2025 and remained active through at least July 2026. It combines more than twenty payloads delivered over SSH tunnels to target seed phrases, wallet files, and browser data.
Cryptocurrency Wallets Security Review of OkoBot Components
OkoBot operates as a modular framework with distinct implants for specific tasks. SeedHunter injects phishing screens into Ledger and Trezor hardware wallet applications to capture recovery phrases. OkoSpyware monitors over one hundred applications, records keystrokes, and captures video of wallet and password manager windows. Additional modules include the MC Keylogger, browser extension loaders that install the Rilide stealer, and tools for credential theft and persistence on infected systems.
The framework also supports remote access via RDP and SSH, disables Windows Defender notifications, and deploys further malware on demand. Russian-language comments in the code and geoblocking of command-and-control servers for Russian and CIS IP addresses point to possible Russian-speaking operators, though no confirmed attribution to a known group exists. These capabilities create multiple paths for cryptocurrency theft that extend beyond simple keylogging.
Victims numbered in the hundreds across more than twenty-five countries, with the highest concentrations reported in Brazil, Vietnam, Canada, Mexico, and Türkiye. Activity also appeared in Germany and additional locations. The campaign continued to evolve after the initial discovery, with potential for further expansion as of the July 2026 Kaspersky report.
Infection Vectors and Detection Timeline
Primary delivery methods rely on social engineering rather than software exploits. ClickFix tactics trick users into executing malicious PowerShell commands. Attackers also upload trojanized versions of legitimate tools to GitHub repositories, including copies disguised as SQL Server Management Studio. Once installed, the initial TookPS downloader establishes the SSH tunnel and fetches the remaining payloads.
No major public updates on OkoBot appeared after the July 2026 disclosure through October 2026. The threat description at that time emphasized ongoing activity and the risk of continued development. Organizations and individual users can reduce exposure by avoiding unsolicited PowerShell commands and verifying the authenticity of software downloaded from public repositories.
Practical Steps to Limit OkoBot Exposure
Users should verify software hashes against official sources before installation and enable hardware wallet confirmation prompts that cannot be overridden by screen overlays. Regular monitoring of account activity and use of dedicated devices for cryptocurrency transactions add further layers of protection. Multi-signature wallet configurations can also limit the impact if one seed phrase is compromised.
| Component | Primary Function | Target |
|---|---|---|
| SeedHunter | Phishing overlay injection | Ledger/Trezor apps |
| OkoSpyware | Keystroke and screen capture | Wallet and password apps |
| Rilide loader | Browser extension deployment | Credential theft |
| MC Keylogger | Input recording | General credentials |
These measures address the specific techniques observed in the OkoBot campaign while applying to broader cryptocurrency wallet security concerns.
Frequently asked questions
How does OkoBot reach cryptocurrency users?
OkoBot spreads primarily through ClickFix social engineering that prompts users to run malicious PowerShell commands and through trojanized software uploaded to GitHub repositories disguised as legitimate tools.
Which wallets does the malware target most directly?
SeedHunter specifically targets Ledger and Trezor hardware wallet applications by injecting fake recovery screens, while OkoSpyware monitors a wide range of wallet and password manager windows across desktop applications.
What signs indicate possible OkoBot infection?
Unexpected PowerShell activity, new browser extensions that were not installed manually, disabled Windows Defender notifications, and unusual remote access connections may indicate compromise by components of the framework.
Has OkoBot activity stopped since the Kaspersky report?
No confirmed major updates appeared after the July 2026 disclosure. The threat was described as ongoing with potential for further evolution as of October 2026.
TrustScope
Comments 5