Kaspersky‘s Global Research and Analysis Team (GReAT) published its OkoBot crypto wallet attack findings on 15 July 2026, revealing a modular framework that has reached victims across more than 25 countries, a substantially wider footprint than the five-country figure that circulated in earlier coverage.
The framework has been active for over a year. Kaspersky’s investigation began in January 2026 after researchers identified multiple attacks tied to the same malware family, which itself evolved from an earlier TookPS campaign first flagged in 2025 that spread a Trojan downloader via fake software websites.
Inside the OkoBot Crypto Wallet Attack Chain
Distribution runs through trojanised GitHub repositories disguised as legitimate tools. In one documented case reported by BleepingComputer, a repository purporting to offer SQL Server Management Studio delivered a repackaged Audacity installer. The payload: a malicious library, protobuf.dll, that decrypted and launched OkoBot’s plugin dispatcher upon execution.
Initial access relies on ClickFix social engineering. Victims are presented with fake error messages or verification steps and instructed to paste commands into their own terminals. Those commands silently install the framework without any file-download prompt.
Once on a machine, roughly 20 modules divide the workload. The Kaspersky Securelist technical report details how the SeedHunter component injects an implant into three specific applications: Trezor Suite, Ledger Wallet, and Ledger Live. When a connected hardware wallet is detected, SeedHunter displays a distinct hard-coded phishing page for each wallet type, capturing the recovery phrase the user enters.
Exfiltration is precise. SeedHunter packages the captured seed phrase into a JSON payload containing wallet type, device information, hardware identifiers, and the phrase itself, then sends it to the operator’s server. A local RC4-encrypted backup is written to the temporary directory as sh_<timestamp>.json, using the victim’s hardware ID as the encryption key.
The MC Keylogger module records keystrokes and monitors clipboard activity, catching passwords and copied wallet addresses. OkoSpyware goes further: it maintains a watch-list of over 100 executable names, including Exodus, Litecoin QT, KeePassXC, and 1Password, and uses a bundled FFmpeg instance to record MP4 video streams of targeted application windows.
A browser extensions loader rounds out the surveillance surface. It injects into Chrome to silently install and conceal malicious extensions, including one called Rilide that targets credentials, cookies, and financial data. Collected artefacts route to an ir-post.php endpoint, after which local files and PowerShell history are deleted, complicating forensic recovery.
Blockchain transfers are irreversible. Once a seed phrase reaches the operators, wallet contents are gone.
ClickFix and the Broader Threat to Crypto Developers
The OkoBot crypto wallet attack is the latest in a string of ClickFix campaigns targeting the sector. North Korea’s Lazarus Group used the same technique in a macOS campaign dubbed Mach-O Man, as reported by crypto.news in April, sending fake meeting invitations to fintech and crypto executives. Victims who followed the verification instructions installed malware that exfiltrated cryptocurrency and corporate data; the toolkit deleted itself post-execution to hinder analysis.
Developer tooling has been another vector. In May, TrapDoor malware spread through poisoned package repositories targeting builders across crypto, DeFi, and AI infrastructure, seeking wallet data, API keys, cloud credentials, and SSH access tied to ecosystems including Coinbase, Binance, MetaMask, Solana, Sui, and Aptos.
OkoBot’s origins carry a further detail. The Hacker News notes that Kaspersky found Russian-language comments embedded in SeedHunter’s source code, and BleepingComputer reports the campaign uses an infostealer actively promoted on invitation-only Russian cybercrime forums. Kaspersky stopped short of formally attributing OkoBot to a specific threat actor. The operators also blocked IP ranges from Russia and other Commonwealth of Independent States countries, a common operational-security pattern among Russian-speaking groups.
The modular design is the key risk multiplier: each module can be updated or swapped independently, and the framework can simultaneously harvest seed phrases, keylog credentials, record screen activity, and exfiltrate browser session data from a single infected host. Any wallet tied to an infected machine should be considered compromised; the only recovery path is moving funds to a fresh address generated on a clean device before the operators act.
