# OkoBot Malware Framework Weaponizes Hardware Wallet Software to Steal Cryptocurrency Recovery Phrases
A sophisticated malware framework called OkoBot has been systematically targeting cryptocurrency hardware wallet users since April 2025, according to a detailed analysis published Wednesday by Kaspersky's GReAT research team. The framework's primary weapon is a specialized module called SeedHunter that injects malicious code directly into legitimate Ledger and Trezor wallet applications, tricking users into voluntarily surrendering their recovery phrases—the cryptographic keys that unlock access to all their cryptocurrency holdings.
Kaspersky's telemetry has identified hundreds of victims across more than 25 countries, with the heaviest concentrations in Brazil, Vietnam, Canada, Mexico, and Türkiye. The framework remains active as of mid-July 2026 and carries more than 20 distinct payloads and implants designed to establish persistent access to infected systems.
## The Threat: SeedHunter's Injection Strategy
The SeedHunter module represents a particularly dangerous evolution in cryptocurrency theft. Rather than attempting to compromise the hardware wallets themselves—which are designed to be tamper-resistant—it compromises the legitimate desktop software that users interact with.
How the attack works:
The sophistication lies in the fact that the legitimate wallet application continues to run normally. Users see the official interface they expect, making the injected phishing request appear to come from the software itself. The attacker has effectively turned the user's trusted tool against them.
## Background and Context: A Familiar Attack Pattern with New Delivery Methods
While the injection technique itself builds on existing malware concepts, OkoBot's distribution mechanisms and comprehensive toolset mark it as a well-resourced operation.
Prior similar attacks:
OkoBot's distribution methods:
OkoBot reaches victims through two primary infection vectors:
1. ClickFix social engineering: Users are redirected to malicious pages that appear to offer technical support and deliver malware through fake support notifications
2. Trojanized GitHub repositories: Attackers uploaded a repository posing as SQL Server Management Studio (SSMS), a widely-used database tool. The uploaded files actually contained Audacity, the open-source audio editor, recompiled with embedded malware. The malicious repository ranked high in search results and remained active from late March 2025 until June 2026.
Both entry points execute TookPS, a PowerShell downloader that Kaspersky has tracked since March 2025. This downloader initially propagated via fake DeepSeek pages and later through lookalike business-software distribution sites.
## Technical Details: Multi-Stage Infection and Persistence
OkoBot's architecture reveals significant sophistication in both its initial deployment and long-term persistence mechanisms.
### Initial Access and Reconnaissance
Once TookPS executes on a target machine, it:
### Persistence and Access
The framework then establishes multiple layers of persistence:
| Persistence Method | Purpose |
|-------------------|---------|
| Firewall rule modification | Opens inbound RDP access |
| Remote Desktop Users group membership | Grants RDP login privileges |
| termsrv.dll patching | Enables concurrent RDP sessions (default Windows limits to one) |
| Scheduled task "Apple Sync" | Rebuilds SSH reverse tunnel every hour for RDP access |
| PowerShell downloader in startup | Ensures TookPS executes on each boot |
### Privilege Escalation and Module Delivery
A VMProtect-packed launcher called HDUtil delivers additional modules and silently escalates privileges using a Windows RPC UAC bypass documented by Google Project Zero in 2019. Modules arrive over SFTP and are executed through this dispatcher.
Kaspersky recovered five distinct plugins from active OkoBot installations:
The main dispatcher polls its command-and-control infrastructure every 20 seconds for updated instructions, allowing attackers to add new capabilities or pivot to fresh targets without requiring victims to download completely new malware.
## Implications: Who Is at Risk
This threat particularly endangers several populations:
Cryptocurrency holders: Anyone with a Trezor or Ledger hardware wallet using the affected desktop software on a compromised Windows PC faces the risk of complete cryptocurrency loss. Even users with strong passwords and two-factor authentication are vulnerable, as the recovery phrase is the master key that bypasses all other security.
Supply chain targets: The use of trojanized GitHub repositories shows attackers are directly targeting developers and technical professionals—users more likely to have significant cryptocurrency holdings and less likely to fall for obvious phishing.
Victims in targeted regions: Kaspersky's telemetry suggests concentrated targeting in Brazil, Vietnam, Canada, Mexico, and Türkiye, which may indicate either regional criminal operations or organized campaigns targeting specific markets.
Users of business software: The SSMS impersonation demonstrates that attackers are willing to compromise the download experience for widely-used professional tools, not just cryptocurrency-specific software.
## Recommendations for Organizations and Individuals
For cryptocurrency holders:
For security teams:
For incident response:
If compromise is suspected, immediate actions should include:
## HackWire Analysis
OkoBot demonstrates a critical shift in cryptocurrency-targeting malware: attackers have moved beyond trying to crack wallets and now focus on compromising the software that users trust to manage them. The sophistication isn't in the individual components—code injection, SSH tunneling, and credential theft are well-known techniques—but in their orchestration into a unified, long-term infection framework.
What makes this campaign particularly noteworthy is the patience and infrastructure investment. A framework that's been running for 15+ months, distributed through supply chain compromise, equipped with UAC bypass exploits and dynamic plugin systems, represents a threat model that most enterprise security teams should recognize: this is not a smash-and-grab malware operation, but a persistent access platform designed for sustained value extraction.
The GitHub impersonation angle deserves specific attention. By compromising the download experience itself—not just delivering malware, but impersonating legitimate software—attackers bypass the heuristic most users rely on: "I downloaded from the official source." For developers and technical professionals in the target regions, the attack surface is now their entire development workflow.
The real risk is that users did the right things: they used hardware wallets, they installed official-looking software, they kept their keys offline in a physical device. And none of that mattered because the device's companion software was compromised. This reinforces an uncomfortable truth: cryptocurrency security is only as strong as the ecosystem around the wallet, not just the wallet itself. Until wallet vendors can guarantee the integrity of their desktop applications, or users completely air-gap their key entry process, supply-chain attacks against wallet software will remain profitable.
— HackWire Editorial
## Related Coverage