Kaspersky Researchers Detect OkoBot Malware Targeting Crypto Wallet Seed Phrases

Kaspersky security researchers have identified a new malware strain called OkoBot that uses about 20 modules to steal crypto wallet seed phrases and credentials. According to ChainCatcher, attackers spread the malware through GitHub repositories disguised as legitimate tools such as SQL Server Management Studio and use ClickFix social engineering to trick users into running malicious commands. The malware includes a SeedHunter module that injects fake recovery screens into Trezor and Ledger hardware wallets, an MC Keylogger that records keyboard and clipboard activity, and OkoSpyware, which tracks wallet passwords and records window video. Kaspersky said that once attackers obtain a seed phrase, they can fully control a victim's crypto assets, and the funds are nearly impossible to recover. The company said OkoBot has existed for more than a year, with most victims located in Brazil, Vietnam, Canada, Mexico, and Turkey. Attackers have also geo-blocked IP addresses from Russia and CIS countries.