Kaspersky researchers identify OkoBot malware targeting crypto wallet seed phrases and credentials

Kaspersky security researchers have identified a new malware strain called OkoBot that is designed to steal cryptocurrency wallet seed phrases and credentials, according to Bits.media. The malware reportedly uses roughly 20 modules and relies on ClickFix social engineering to trick users into running malicious commands on their own devices. Researchers said the campaign is also being distributed through GitHub repositories disguised as legitimate tools, including SQL Server Management Studio. Several modules were highlighted in the report. SeedHunter targets hardware wallets such as Trezor and Ledger by injecting itself into the recovery process and showing a fake interface when users enter seed phrases. MC Keylogger records keyboard input and clipboard activity, while OkoSpyware tracks wallet passwords and captures window video. Kaspersky said that once attackers obtain a victim’s seed phrase, they can take full control of the related crypto assets, leaving little chance of fund recovery. The company added that OkoBot has been active for more than a year. Most victims were located in Brazil, Vietnam, Canada, Mexico, and Turkey. The attackers also geofenced IP addresses from Russia and CIS countries.