OkoBot is an advanced malicious modular platform that targets stealing cryptocurrency, seed phrases from hardware and software wallets, and users’ credentials.

The campaign has been active since the beginning of 2025 and has hundreds of victims across more than 25 countries, with the attackers’ main targets being developers and IT specialists.
------------------------------
The malware is delivered to Windows devices via two main routes:

ClickFix technique: the use of social engineering, where users are tricked into copying and running malicious code (usually through a PowerShell script called TookPS) directly in the console.

Trojanized software on GitHub: malicious code is disguised as popular automation utilities or legitimate IT tools, for example as a fake installer for SQL Server Management Studio (SSMS).

In the initial stage of the attack, an SSH bot is loaded, which collects system information, opens RDP ports, disables Windows Defender notifications, and sets up a tunnel to deliver the remaining modules via SFTP.
------------------------------
From more than 20 OkoBot components, researchers identify four most dangerous spyware implants.

SeedHunter: tracks the launch of official desktop applications for hardware wallets (Trezor Suite, Ledger Wallet, Ledger Live). When a device is connected, the module injects a fake phishing authorization window directly inside the original program and prompts the user to enter a seed phrase for “recovery”.

OkoSpyware: a specialized surveillance module that monitors more than 100 popular crypto wallets (including Exodus, MetaMask, Tonkeeper) and password managers (for example, 1Password). Using an embedded FFmpeg library, it records the video stream of the active window of the wallet and intercepts keystrokes.

ext daemon (extl.exe): injected into Chromium browsers to covertly install malicious extensions (such as the Rilide stealer), which steal cookies, sessions, and payment data directly during browsing.

MC Keylogger: a classic keylogger that continuously records keyboard input, monitors the clipboard (where wallet addresses and keys are often copied), and takes screenshots every 5 minutes.
------------------------------ OkoBot developers use geoblocking—attacker servers return an empty response and do not deliver the payload if requests come from IP addresses in Russia and CIS countries. However, inside the phishing page code of the SeedHunter module, researchers found text comments in Russian.

Hardware wallets themselves remain protected. The main security rule is never to type a seed phrase on your computer keyboard in the interface of the programs. If the official app suddenly asks you to enter 12 or 24 words when connecting a device (without an explicit command on the hardware wallet itself), that is a sign of SeedHunter.
------------------------------
To minimize the risk of infection by infostealers, the following defensive measures are used:

Using hardware wallets: keeping private keys and seed phrases on isolated physical devices eliminates the possibility of their theft via stealer modules.

Encryption and password hygiene: refusing to save passwords in the browser in favor of dedicated password managers with a strong master password.

Multi-factor authentication (MFA): using two-factor authentication (preferably via hardware keys or authenticator apps) protects accounts even if the password was stolen.

Process monitoring (EDR): using endpoint threat detection systems (EDR) to identify suspicious activity, such as массовое reading of files in browser profile directories or unauthorized network requests to unknown IP addresses.

$BTC $ETH $GT