OkoBot Malware Targets Crypto Seed Phrases with Fake Wallet Screens

July 19, 2026

Daily Feed

#Seed Phrases #Kaspersky #OkoBot #Malware Framework

OkoBot Malware Targets Crypto Seed Phrases with Fake Wallet Screens

OkoBot is the kind of malware that doesn’t bother “hacking the blockchain.” It goes after the softer target: the person at the keyboard, then the seed phrase that can hand over an entire wallet.

OkoBot is modular, one report says it is built from roughly 20 separate modules.
It targets recovery phrases, the master key to crypto wallets, including Bitcoin wallets.
It leans on social engineering, fake downloads, malicious commands, and counterfeit wallet screens.
Kaspersky did not attribute it, the campaign’s operator remains unknown.

According to coverage tied to Kaspersky research, OkoBot is a modular malware framework designed to steal cryptocurrency wallet recovery phrases, better known as seed phrases. One summary says the framework is made up of about 20 modules, which is exactly the sort of structure that makes modern malware flexible, hard to pin down, and annoying as hell to clean up.

Seed phrases are not just another password with a cooler name. In most wallets, a 12- or 24-word recovery phrase is the master key. Whoever has it can usually restore the wallet on another device and move the funds. That is why this kind of theft is so dangerous: no need to “break” Bitcoin, no need to brute-force keys, no need for some theatrical cyberpunk nonsense. Trick the user once, and the wallet can be gone.

The Kaspersky-linked reporting describes OkoBot as more than a single infostealer. It appears to use a plugin dispatcher that checks in with command-and-control infrastructure every 20 seconds. Kaspersky reportedly recovered five plugins from the campaign. The function list is nasty: one component is said to act as a process injector to load SeedHunter; another, OkoSpyware, watches for more than 100 executables, including wallets and tools such as Exodus and 1Password, then records video of matching windows into MP4 files using bundled FFmpeg. A separate MC Keylogger reportedly captures keystrokes, clipboard data, USB activity, and screenshots every five minutes.

That’s not a single-purpose stealer. That’s a toolkit built to harvest whatever valuable data shows up on an infected machine.

The browser layer is just as grim. The reporting says OkoBot matches browser tabs with regular expressions, so wallet-related pages such as MetaMask or Tonkeeper can be recorded. It also loads hidden Chromium extensions with broad permissions. One reported component installed Rilide, a Chromium stealer linked by researchers to Russian-speaking threat actors since April 2023. In plain English: the malware can turn the browser into a surveillance and theft machine while the user thinks they are just browsing normally.

That matters because many crypto users treat the browser as safe by default. It isn’t. If an attacker can abuse the browser, they can watch wallet activity, capture pages, grab input, and potentially manipulate sessions. The browser is often where convenience and bad judgment go to die.

The infection chain appears to rely heavily on social engineering rather than any magical zero-click exploit. According to the coverage, victims are steered toward fake GitHub repositories that look like legitimate tools, including a bogus Microsoft SQL Server Management Studio build. Another technique mentioned is ClickFix, a scam that persuades users to copy and run malicious commands themselves. That’s the ugly truth here: a lot of so-called “advanced” attacks are still just confidence tricks with a terminal window.

One reported component, SeedHunter, displays a counterfeit interface meant to resemble Ledger or Trezor and pushes the victim to type in a recovery phrase. That is the central fraud. Hardware wallets are still a strong defense when used properly because the private keys are supposed to stay offline. But once someone enters the seed into a fake window, the whole protection model collapses. The device is fine. The human trust model is not.

The campaign has reportedly affected users in at least five countries: Brazil, Vietnam, Canada, Mexico and Turkey. The reporting also says the operators block IP addresses from Russia and CIS nations. There are Russian comments on some phishing pages, and the first-stage PowerShell server reportedly returns an empty response to Russian and CIS IPs, but those are clues, not proof. Kaspersky reportedly said it could not attribute the campaign to any known crimeware group, which is the right level of caution. Cyber attribution by vibes is how bad intelligence gets made.

That distinction matters. This is not a Bitcoin protocol failure. It is an endpoint and social-engineering attack. The malware is going after the weak points around crypto security: fake installers, fake wallet pages, malicious browser extensions, keystroke logging, clipboard scraping, and command-line tricks that get users to run the attack for them.

Bitcoin itself doesn’t get “hacked” because someone typed a seed phrase into a phony recovery screen. The network still does what it is designed to do. The failure happens at the edge, where wallets, browsers, and user habits meet a very untrustworthy internet.

The practical lesson is blunt: never enter a recovery phrase into a website, pop-up, random app, or “support” tool. Seed phrases are for backup and restoration under controlled conditions, not for casually typing into whatever shiny box appears on screen. If a tool asks for your recovery words, assume it is trying to steal them until proven otherwise.

Key takeaways

What is OkoBot?
It is a modular malware framework described in recent Kaspersky reveals a new malicious framework targeting coverage as built to steal crypto wallet recovery phrases and other sensitive data from infected machines.
Does it only target Bitcoin?
No. The reporting points to cryptocurrency wallets more broadly. Bitcoin wallets are part of that threat surface, but the campaign is not Bitcoin-only.
Why are seed phrases such a big deal?
Because they usually let an attacker restore and fully control a wallet. If the phrase is compromised, the wallet is usually compromised too.
How does the malware spread?
The reporting links it to social engineering, fake GitHub repositories, malicious command execution, and ClickFix-style tricks that persuade users to run harmful commands themselves.
Can hardware wallets stop this?
They help a lot, but only if the seed phrase stays offline. A hardware wallet cannot protect someone who types the recovery phrase into a fake interface.
Was the operator identified?
No. Kaspersky reportedly said it could not attribute the campaign to any known crimeware actor.

The simplest way to read this threat is also the most accurate: OkoBot is not breaking crypto. It is breaking trust. And in practice, that is often easier.