OkoBot: new sophisticated malware framework targets cryptocurrency users

OkoBot is a sophisticated malware framework targeting cryptocurrency users, active since January 2026. It uses a multi-stage infection chain initiated by the malicious PowerShell script TookPS, delivered via fake software repositories or phishing. The framework deploys over 20 malicious payloads through an SSH tunnel, enabling UAC bypass, browser extension injection, keylogging, screen recording, and seed phrase theft from Ledger and Trezor wallets. The campaign remains active and has infected hundreds of victims across more than 25 countries, with evidence suggesting Russian-speaking threat actor involvement.

AI-extracted · verify before operational use