New malware framework targets retail crypto investors

TLDR

A newly identified malware framework called OkoBot is actively stealing crypto from retail users by compromising their computers and even their hardware wallet software.

1. OkoBot uses social engineering and trojanized software to infect machines, then modules like SeedHunter harvest seed phrases and wallet data from Ledger and Trezor apps.
2. The campaign has already hit hundreds of users in more than 25 countries, with a focus on both retail investors and developers using fake GitHub projects and tools.
3. The most effective defenses are strict download hygiene, never typing seed phrases into any app, and separating your crypto environment from everyday gaming and work devices.

Deep Dive

1. How OkoBot Attacks Crypto Users

Kaspersky describes OkoBot as a modular malware framework that starts with social engineering, such as ClickFix prompts that trick users into running malicious commands or installing trojanized tools from fake GitHub repositories and installers disguised as legitimate software like Microsoft SQL Server Management Studio.

Once installed, OkoBot deploys components including SeedHunter, which injects code into Ledger and Trezor desktop applications to show phishing recovery screens and capture seed phrases, along with spyware modules that log keystrokes, record wallet windows, and grab browser credentials and cookies. This lets attackers drain wallets and exchange accounts even if users never directly type their private keys into a website, as detailed in Kasperskys OkoBot analysis.

2. Why Retail Investors Are Especially Exposed

Kaspersky reports hundreds of victims across more than 25 countries, with high victim counts in Brazil, Vietnam, Canada, Mexico, and Trkiye, showing that everyday retail users are being targeted at scale. Many keep exchange logins, browser auto-fill credentials, and wallet apps on the same machine where they install tools and games, which OkoBot explicitly abuses.

Hardware wallet users are not immune. If you type your seed phrase into a phishing screen inside a compromised Ledger or Trezor app, the devices offline model no longer protects you. OkoBots keyloggers and video capture modules can also record wallet activity and clipboard contents, making copy-pasted addresses and approval flows risky on infected devices.

3. Practical Defenses And Signals To Watch

1. Download only from official sites and verified stores, and be skeptical of one-click fixes, install scripts, or repos you do not actively audit.
2. Never type a seed phrase or recovery phrase into any app, pop up, or form, including updates to hardware wallet software. Recovery should happen only via the devices physical interface.
3. Use a dedicated device for significant crypto holdings, keep security software active, enable multi factor authentication for exchanges and email, and regularly review connected wallets and approvals. Developers should treat fake repos and unsolicited helpful tools as high risk.

Conclusion

OkoBot shows that modern crypto theft increasingly combines social engineering with deep endpoint compromise, targeting both retail investors and the tools they rely on. Protecting your assets now depends less on a single safe wallet and more on disciplined operational security around downloads, recovery phrases, and the devices that touch your crypto.