OkoBot Malware Emerges as New Threat Targeting Crypto Wallet Users

Global cybersecurity company Kaspersky has identified a new and sophisticated malware framework called OkoBot, designed primarily to steal cryptocurrency wallets, seed phrases, login credentials, and other sensitive information. According to Kaspersky's Global Research and Analysis Team (GReAT), the malware was first detected in January 2026. Kaspersky Bangladesh shared the findings on Wednesday.

According to the company, OkoBot contains more than 20 malicious modules capable of stealing cryptocurrency wallets, recovery seed phrases, login credentials, locally stored files, browser extensions, keystrokes, and on-screen activities. The malware can also execute remote commands on compromised devices.

Researchers said OkoBot is mainly distributed through ClickFix social engineering techniques and fake GitHub software packages, including counterfeit installers for SQL Server Management Studio.

One of its modules, called SeedHunter, specifically targets users of Trezor Suite, Ledger Wallet, and Ledger Live. It injects malicious code into the software and displays fake phishing pages designed to trick users into revealing their hardware wallet recovery seed phrases.

Dmitry Galov, Head of Kaspersky's GReAT Russia & CIS Unit, said, "The OkoBot campaign has remained active for more than a year and continues through July 2026. Based on the infection techniques we observed, software developers appear to be one of its primary targets. More concerning is that the malware continues to evolve, increasing the likelihood of spreading to more users and additional countries."

Although no specific threat actor has yet been officially linked to the campaign, Kaspersky noted that certain tactics and code characteristics indicate possible connections to Russian-speaking cybercriminals.

To reduce security risks, Kaspersky advises users to avoid executing code or following instructions from unknown or unverified sources. The company also recommends using trusted security software, keeping systems updated, enabling multi-factor authentication (MFA), using strong and unique passwords, and storing recovery seed phrases in a secure password manager instead of text files or smartphone photos.
//DBTech/CS/SME//