Kaspersky GReAT Unveils OkoBot Malware Framework: Specifically Designed to Steal Cryptocurrency Wallet Mnemonics, Browser Cookies, and More
Coin Circle (120btc.CoM): Kaspersky's Global Research and Analysis Team (GReAT) has unveiled a malware framework named OkoBot. This framework comprises over 20 types of malicious programs and implants that operate collaboratively through SSH tunnels, specifically designed to steal mnemonics from cryptocurrency wallets, browser cookies, and account passwords, having infiltrated hundreds of users across 25 countries worldwide.
OkoBot Framework: 20 Types of Malware Collaborating
OkoBot is not a single piece of malware but a complete modular attack framework. Kaspersky detailed the entire infection chain in a Securelist technical report: TookPS downloader is responsible for the initial intrusion → SSHbot collects system information and establishes a reverse tunnel → HDUtil launcher deploys various malicious modules → ultimately sending stolen data back via SFTP.
The framework includes five main plugins:
- CMD Wrapper (10xx): Executes command codes and individual instructions within the system
- PowerShell Wrapper (11xx): Supports execution of PowerShell command codes
- Environment Enumerator (12xx): Collects system information, active sessions, and processes
- Downloader (14xx): Downloads additional payloads from embedded Base64 binary blobs or URLs
- Process Injector (16xx): Injects malicious implants into normal processes
SeedHunter: Stealing Ledger and Trezor Mnemonics
One of the core modules, SeedHunter, monitors active processes in the system and injects implants into applications like Trezor Suite, Ledger Wallet, and Ledger Live. When a connected hardware wallet is detected, SeedHunter displays a hardcoded phishing page requesting the user to input their mnemonic. This page uses different layouts for each wallet type, and the stolen mnemonics are subsequently sent back to the C2 server encrypted with RC4.
Kaspersky specifically pointed out in its official press release that the infection routes for OkoBot mainly include ClickFix click fraud and disguised software distributed via GitHub. Researchers identified cases of fake SQL Server Management Studio installers that were actually embedded with malicious implants in the Audacity audio editor.
OkoSpyware: Simultaneously Recording Keystrokes and Screens
The newly added OkoSpyware module captures both keyboard inputs and video streams of target application windows. It lists over 100 executable names, including cryptocurrency wallets like Exodus and Litecoin QT, password managers like KeePassXC and 1Password, as well as various commonly used applications. For each identified process, OkoSpyware uses a built-in FFmpeg instance to record MP4 videos while simultaneously logging keystrokes.
Browsers are not exempt; when OkoSpyware detects the window title of wallet extension pages like MetaMask or Tonkeeper, it automatically starts recording video and input, writing the window title into a JSON relay data file.
Active for Over a Year, Developers as Primary Target
The infection chain of OkoBot has been operational since April 2025, continuing for over a year and still evolving. Kaspersky researchers noted that the countries most affected by attacks include Brazil, Vietnam, Canada, Mexico, and Turkey. While it is currently impossible to attribute the attacks to a specific criminal group, technical analysis has revealed traces of Russian-language code, and the espionage program used by the malware (Rilide) is widely circulated on Russian-language cybercrime forums.
Kaspersky warned in the report that the ongoing evolution of the OkoBot framework indicates that the backend maintainers are still actively developing it. As distribution activities continue, the framework has the potential to impact more cryptocurrency users and developers.
Disclaimer: This content is provided for general branding and informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online events, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets or to use any services. Crypto assets are highly volatile and may result in loss. WEEX services and online events may not be available in all regions and are subject to applicable laws, regulations, and eligibility requirements. You are responsible for ensuring that your use of WEEX services complies with local laws and for carefully assessing the risks before participating in any crypto-related activities.
You may also like

Record High for the World Cup: $5.7 Billion in Bets on Kalshi and Polymarket

Andy Burnham Sworn in as UK Prime Minister... "Ending Political Instability with a New Economic Model"

United Kingdom: Andy Burnham, a Prime Minister "convinced" by crypto at the gates of Downing Street

Aave Picks Chainlink CCIP As Default Standard For Cross-Chain sGHO

Who is Capturing Value in Web 2.5?

Tesla Earnings Put 11,509 BTC Treasury Back In Focus

Is Shiba Inu (SHIB) Dead? On-Chain Data Shows a Sad Reality

Why the U.S. Stock Market Often Declines During Midterms

Bitcoin BIP-361 Draft Puts Quantum Security Back On The Agenda

Former Microsoft AI Team Launches Skyfall AI, Plans to Invest $1 Million to Test 'AI CEO' Model

The fed chair who owned crypto just ruled out saving it

Europe Gets A Bitcoin-Backed Preferred Stock As Treasury Demand Spreads

Stock Market: After AI Euphoria, KOSPI Plummets and Triggers Market Alert

What is a tokenized deposit? Bank money goes on-chain

142 Gatherings, $98 Billion Blocked: The Anti-AI Data Center Revolt Gains Momentum

Why stablecoin wallets have no deposit insurance

Will Artificial Intelligence Destroy the Bitcoin Mining Economy?

The systemic risk exception: how SVB saved USDC by accident

Water in Lviv May Rise to 56 UAH per Cubic Meter: What We Know

Bitcoin Under Pressure as Brent Rises Nearly 4%

Van de Poppe: waiting to buy bitcoin at USD 40,000 is "a stupid idea"

Bernstein lifts Robinhood target to $160, sees prediction markets revenue overtaking crypto

Analysis: Coinbase's Base Strategy Misstep Exposes Challenges in Crypto Industry Transformation, Needs to Shift from Speculative Era to Financial Infrastructure

HIP-3 Perpetual Futures Arbitrage Practice: Trading Opportunities in SK Hynix ADR Premium

The "Invisible Winner" of the World Cup! Prediction Markets Attracting Billions, Betting Giants' Market Share Eroded

Crypto security audits lose trust as institutions demand live monitoring

Report on the Crypto Industry in Q2 2026

Ethereum and Solana ETFs: Grayscale to Pay Staking Rewards in Cash Quarterly

Capital B plans 10-for-1 reverse stock split for September







