OkoBot Framework Uses 20+ Modules to Steal Cryptocurrency Wallet Seed Phrases
Do Son 
New OkoBot infection chain | Image: Kaspersky Labs
At a Glance
| Malware family | OkoBot framework (TookPS lineage; 20+ payloads and implants) |
| Threat actor | Unattributed; suspected Russian-speaking operator |
| Targets | Hundreds of victims in 25+ countries, led by Brazil and Vietnam |
| Delivery vector | ClickFix lures and fake software on GitHub |
| Key capabilities | Seed phrase phishing, keylogging, screen recording, RDP access |
| Source | Kaspersky (Securelist) |
TL;DR
Kaspersky identified attacks in January 2026 that captured the contents of cryptocurrency wallet windows. Researchers traced them to a four-stage framework they named OkoBot, which delivers more than 20 payloads over an SSH tunnel. The campaign has run for over a year, and Kaspersky says “the threat remains active.”
Why the OkoBot Framework Matters
Most stealers grab files and leave. This one builds a full remote-control platform on the victim’s machine. It hunts hardware wallet seed phrases, records video of wallet windows, and opens RDP access for the operator. Kaspersky counted hundreds of victims in more than 25 countries between April 2025 and June 2026. Brazil, Vietnam, Canada, Mexico, and Türkiye saw the most attacked users.
Delivery
Two vectors start the chain. The first is a ClickFix lure. The second is malware on GitHub dressed as legitimate software. One repository posed as a SQL Server Management Studio package. In reality, it was the Audacity audio editor rebuilt with a malicious implant inside one of its libraries. Search engines indexed the repo, so it ranked at the top for the product name and looked trustworthy.
Infection Chain
Both paths run a PowerShell downloader called TookPS. That script installs SSH, dials an attacker server, and forwards a local port. An automated SSH bot then connects back.
The bot inventories the host, then harvests wallet files, browser cookies, and credentials through the tunnel. Next, it quiets Windows Defender notifications through a registry change. It also carves out graphical access: opening firewall ports for RDP, adding a user to the Remote Desktop Users group, swapping the terminal services library for a patched build that allows concurrent sessions, and creating an hourly scheduled task disguised with an innocuous name.
Modules then arrive over SFTP. A launcher protected with VMProtect runs them, with an optional UAC bypass built on a technique Project Zero documented back in 2019. One module injects into Chromium browsers and installs hidden extensions, including the Rilide stealer. Another delivers a plugin dispatcher wrapped in a trojanized library, which hosts wrappers for cmd and PowerShell, an environment enumerator, a dropper, and a process injector.
The Wallet Modules
SeedHunter drives the cryptocurrency wallet theft. It injects into Trezor Suite, Ledger Wallet, and Ledger Live, then hooks internal Electron functions. Meanwhile, it watches USB ports for a connected hardware wallet. Once one appears, it renders a built-in phishing page asking for the recovery phrase, with a distinct layout per wallet brand.
OkoSpyware goes further. It checks over 100 executable names, covering wallets like Exodus plus password managers such as KeePassXC and 1Password. For each match, a bundled FFmpeg instance records MP4 video of that window while logging keystrokes. It also matches browser window titles against patterns for MetaMask and Tonkeeper pages. A separate keylogger captures clipboard text, copied images and file paths, USB device details, and a screenshot every five minutes.
Command-and-Control and Exfiltration
The dispatcher polls its server every 20 seconds using a compact binary format with encrypted JSON. Notably, the operators shipped weak crypto: the payload decryption omits the authentication tag, so no integrity check happens. A scheduled TookPS task pulls a PowerShell exfiltration script that ships the keylogger and spyware artifacts to a web endpoint. Afterward, it deletes those files and clears the PowerShell console history.
Attribution
Kaspersky cannot tie the campaign to any known crimeware actor. However, several signals point one direction. The servers hosting the initial scripts return empty responses to IP addresses from Russia and CIS countries, a habit common among Russian-speaking crews. The campaign also uses Rilide, which circulates on invitation-only Russian-language forums, and the SeedHunter phishing pages carry Russian comments in their source. Treat the operator as suspected, not confirmed.
Defense and Detection
Hunt for unexpected SSH installations and outbound SSH from user endpoints, since that tunnel underpins the whole framework. Additionally, alert on modified terminal services libraries, new members of the Remote Desktop Users group, and scheduled tasks that re-establish tunnels on a timer. Watch temp directories for batches of timestamped JPG, MP4, and JSON artifacts. Verify GitHub projects against the vendor’s official page before downloading, and treat top search results as unvetted. According to Kaspersky’s analysis, the framework keeps evolving; a March 2026 build dropped older components entirely. It “is adapting,” the researchers note, so detections need refreshing.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
