# OkoBot Malware Framework Weaponizes Hardware Wallet Software to Steal Cryptocurrency Recovery Phrases


A sophisticated malware framework called OkoBot has been systematically targeting cryptocurrency hardware wallet users since April 2025, according to a detailed analysis published Wednesday by Kaspersky's GReAT research team. The framework's primary weapon is a specialized module called SeedHunter that injects malicious code directly into legitimate Ledger and Trezor wallet applications, tricking users into voluntarily surrendering their recovery phrases—the cryptographic keys that unlock access to all their cryptocurrency holdings.


Kaspersky's telemetry has identified hundreds of victims across more than 25 countries, with the heaviest concentrations in Brazil, Vietnam, Canada, Mexico, and Türkiye. The framework remains active as of mid-July 2026 and carries more than 20 distinct payloads and implants designed to establish persistent access to infected systems.


## The Threat: SeedHunter's Injection Strategy


The SeedHunter module represents a particularly dangerous evolution in cryptocurrency theft. Rather than attempting to compromise the hardware wallets themselves—which are designed to be tamper-resistant—it compromises the legitimate desktop software that users interact with.


How the attack works:


  • Initial compromise: OkoBot lands on a Windows machine and scans for Trezor Suite, Ledger Wallet, or Ledger Live
  • Code injection: SeedHunter hooks into the application's Electron framework internals, allowing it to manipulate the user interface
  • Conditional triggering: The malware queries its command-and-control server at moonsand[.]store for instructions
  • Smart device detection: If instructed, SeedHunter can wait until a physical hardware wallet is actually plugged in via USB before displaying the phishing page—making the attack feel more contextually relevant to the user
  • Credential capture: When the user enters their recovery phrase, the malware captures it via console logging and exfiltrates it as JSON data, with RC4 encryption applied

  • The sophistication lies in the fact that the legitimate wallet application continues to run normally. Users see the official interface they expect, making the injected phishing request appear to come from the software itself. The attacker has effectively turned the user's trusted tool against them.


    ## Background and Context: A Familiar Attack Pattern with New Delivery Methods


    While the injection technique itself builds on existing malware concepts, OkoBot's distribution mechanisms and comprehensive toolset mark it as a well-resourced operation.


    Prior similar attacks:

  • Moonlock Lab previously documented macOS-based wallet stealers using app substitution
  • Ledger Live has been cloned multiple times, most notably by the AMOS malware, which replaced the legitimate app with a trojanized version demanding the 24-word recovery phrase
  • GlassWorm conducted comparable attacks on Windows using USB device detection via WMI to trigger its payload

  • OkoBot's distribution methods:


    OkoBot reaches victims through two primary infection vectors:


    1. ClickFix social engineering: Users are redirected to malicious pages that appear to offer technical support and deliver malware through fake support notifications

    2. Trojanized GitHub repositories: Attackers uploaded a repository posing as SQL Server Management Studio (SSMS), a widely-used database tool. The uploaded files actually contained Audacity, the open-source audio editor, recompiled with embedded malware. The malicious repository ranked high in search results and remained active from late March 2025 until June 2026.


    Both entry points execute TookPS, a PowerShell downloader that Kaspersky has tracked since March 2025. This downloader initially propagated via fake DeepSeek pages and later through lookalike business-software distribution sites.


    ## Technical Details: Multi-Stage Infection and Persistence


    OkoBot's architecture reveals significant sophistication in both its initial deployment and long-term persistence mechanisms.


    ### Initial Access and Reconnaissance


    Once TookPS executes on a target machine, it:

  • Installs SSH and establishes a reverse tunnel to an attacker-controlled server
  • Awaits connection from an automated SSH bot that inventories the system
  • Silences Windows Defender notifications through registry modification
  • Harvests wallet files, browser cookies, browser profiles, and stored credentials

  • ### Persistence and Access


    The framework then establishes multiple layers of persistence:


    | Persistence Method | Purpose |

    |-------------------|---------|

    | Firewall rule modification | Opens inbound RDP access |

    | Remote Desktop Users group membership | Grants RDP login privileges |

    | termsrv.dll patching | Enables concurrent RDP sessions (default Windows limits to one) |

    | Scheduled task "Apple Sync" | Rebuilds SSH reverse tunnel every hour for RDP access |

    | PowerShell downloader in startup | Ensures TookPS executes on each boot |


    ### Privilege Escalation and Module Delivery


    A VMProtect-packed launcher called HDUtil delivers additional modules and silently escalates privileges using a Windows RPC UAC bypass documented by Google Project Zero in 2019. Modules arrive over SFTP and are executed through this dispatcher.


    Kaspersky recovered five distinct plugins from active OkoBot installations:

  • SeedHunter (recovery phrase injection)
  • Volume2 (open-source utility weaponized with malicious protobuf.dll)
  • Additional plugins (specific functions not detailed in current analysis)

  • The main dispatcher polls its command-and-control infrastructure every 20 seconds for updated instructions, allowing attackers to add new capabilities or pivot to fresh targets without requiring victims to download completely new malware.


    ## Implications: Who Is at Risk


    This threat particularly endangers several populations:


    Cryptocurrency holders: Anyone with a Trezor or Ledger hardware wallet using the affected desktop software on a compromised Windows PC faces the risk of complete cryptocurrency loss. Even users with strong passwords and two-factor authentication are vulnerable, as the recovery phrase is the master key that bypasses all other security.


    Supply chain targets: The use of trojanized GitHub repositories shows attackers are directly targeting developers and technical professionals—users more likely to have significant cryptocurrency holdings and less likely to fall for obvious phishing.


    Victims in targeted regions: Kaspersky's telemetry suggests concentrated targeting in Brazil, Vietnam, Canada, Mexico, and Türkiye, which may indicate either regional criminal operations or organized campaigns targeting specific markets.


    Users of business software: The SSMS impersonation demonstrates that attackers are willing to compromise the download experience for widely-used professional tools, not just cryptocurrency-specific software.


    ## Recommendations for Organizations and Individuals


    For cryptocurrency holders:


  • Air-gapped approach: Enter recovery phrases only on offline, freshly-wiped systems that have never been connected to a network, or use legacy offline computers reserved specifically for this purpose
  • Hardware wallet practice: Verify the physical hardware wallet's PIN before entering any recovery phrase
  • Multi-signature storage: Consider splitting cryptocurrency across multiple hardware wallets or using multi-signature schemes that require multiple keys
  • System hygiene: Use dedicated systems for cryptocurrency transactions that are isolated from daily browsing and work

  • For security teams:


  • Endpoint detection: Monitor for Electron injection, unusual SSH tunnel establishment, and termsrv.dll modifications
  • Software supply chain: Implement dependency scanning and verify checksums for downloaded software against official sources
  • Browser isolation: Sandbox browser sessions that access download sites or cloud repositories
  • SSH activity: Alert on SSH reverse tunnels and monitor for local port forwarding on critical systems

  • For incident response:


    If compromise is suspected, immediate actions should include:

  • Assuming all cryptocurrency stored on affected systems is compromised
  • Rotating all passwords and cryptographic keys across unaffected systems
  • Inspecting browser history for fake software download sites or compromised repositories
  • Checking Windows Event Logs for termsrv.dll modification timestamps

  • ## HackWire Analysis


    OkoBot demonstrates a critical shift in cryptocurrency-targeting malware: attackers have moved beyond trying to crack wallets and now focus on compromising the software that users trust to manage them. The sophistication isn't in the individual components—code injection, SSH tunneling, and credential theft are well-known techniques—but in their orchestration into a unified, long-term infection framework.


    What makes this campaign particularly noteworthy is the patience and infrastructure investment. A framework that's been running for 15+ months, distributed through supply chain compromise, equipped with UAC bypass exploits and dynamic plugin systems, represents a threat model that most enterprise security teams should recognize: this is not a smash-and-grab malware operation, but a persistent access platform designed for sustained value extraction.


    The GitHub impersonation angle deserves specific attention. By compromising the download experience itself—not just delivering malware, but impersonating legitimate software—attackers bypass the heuristic most users rely on: "I downloaded from the official source." For developers and technical professionals in the target regions, the attack surface is now their entire development workflow.


    The real risk is that users did the right things: they used hardware wallets, they installed official-looking software, they kept their keys offline in a physical device. And none of that mattered because the device's companion software was compromised. This reinforces an uncomfortable truth: cryptocurrency security is only as strong as the ecosystem around the wallet, not just the wallet itself. Until wallet vendors can guarantee the integrity of their desktop applications, or users completely air-gap their key entry process, supply-chain attacks against wallet software will remain profitable.


    — HackWire Editorial


    ## Related Coverage


  • Read more in our [Tools](https://www.hackwire.news/category/tools) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)