New Malware OkoBot is hunting crypto wallets.
A modular Windows stealer with 20+ payloads. It fakes error pages, hijacks GitHub repos, and even pops a fake recovery screen when you plug in your hardware wallet. One seed phrase = your whole balance, gone for good.
Why security teams are sounding the alarm
Most stealers grab files and leave. OkoBot builds a remote-control station on your PC — and waits for the exact moment your wallet is open.
20+ payloads, on demand
A plugin dispatcher pulls only the modules your machine “deserves” — wallet grabbers, keyloggers, video spy, browser hook. Each piece can be swapped without reinfecting you.
Full RDP backdoor
Opens firewall ports, creates a remote-user account, patches termsrv.dll for multi-session RDP and keeps a reverse SSH tunnel alive via a scheduled task named “Apple Sync”.
Phishes your hardware wallet
Injects Trezor Suite, Ledger Wallet & Ledger Live. The moment a device is plugged in, it renders a branded fake recovery page. The hardware stays honest — the app was hijacked.
Records 100+ apps
Watches wallets (Exodus, MetaMask, Tonkeeper, Litecoin QT…) and password managers (KeePassXC, 1Password…), recording window video with a bundled FFmpeg while logging every keystroke.
Your seed phrase is the password to everything. Not a backup, not a support ticket — the master key.
Once it leaves your head and hits a malicious form, the attacker drains the wallet on-chain. No bank, no exchange, no Ledger/Trezor support line can reverse it. Changing the app password changes nothing.
Two doors in. Both are social engineering.
No zero-day required. You are tricked into running the first line yourself — that’s why ClickFix works so well.
“Copy this to fix the error”
A hacked site or fake support page shows a plausible error / captcha / verification step. You copy a block of text and paste it into PowerShell or the Windows Run box (Win+R). It silently fetches and runs the TookPS downloader. No file download prompt, no antivirus pop-up.
“Official tool” at the top of search
A repo mirrors the vendor’s docs and README style perfectly. One real case advertised SQL Server Management Studio — the download was a repackaged Audacity with a malicious protobuf.dll. Indexed by search engines, it outranked the real thing (active Mar–Jun 2025).
You run it
TookPS PowerShell sets up SSH, phones home and forwards a local port. An automated SSH bot connects back.
Recon & persistence
Harvests username, OS build, AV product, IP. Silences Defender alerts via registry, then opens the RDP door and the “Apple Sync” hourly task.
The steal
Wallet files, browser cookies/profiles, saved logins, clipboard & keystrokes. Hidden Chromium extensions (Rilide) are installed and hidden from the extensions page.
Cover the tracks
Artifacts + PowerShell history wiped, temp files encrypted locally as sh_.json, exfil to an ir-post.php endpoint. You notice nothing.
What OkoBot is after
Assume every secret on an infected machine is already in the attacker’s hands.
Seed phrases
Captured via fake recovery pages keyed to each wallet brand, then shipped as a JSON blob (wallet type + HWID + phrase).
Private keys & wallet files
Exodus, MetaMask, Tonkeeper, Litecoin QT, Ledger Live/Trezor Suite data directories vacuumed up whole.
Browser session data
Chromium & Edge cookies, autofill, saved passwords, extension storage — enough to ride your exchange session.
Clipboard & screens
Copied addresses, images, file paths + a screenshot every 5 min. Perfect for swapping a paste-in address mid-transfer.
The 8 habits that actually stop it
Print this. Share it in your server. The whole framework falls apart if you refuse the first two.
❌ Never do this
- Paste a command from a webpage into PowerShell / Win+RReal support never asks you to run a one-liner. Close the tab instead.
- Download a dev tool / wallet “crack” from a random GitHub repoVerify the vendor’s official domain, signed release, and maintainer history.
- Type your seed into any popup — even inside Ledger Live or Trezor SuiteRecovery prompts only appear when *you* initiate recovery. Mid-session = phishing.
- Disable antivirus or click “Run anyway” to install somethingThat UAC bypass in OkoBot was built for this exact moment.
- Keep a large balance on a hot wallet tied to a daily-use PCTreat your trading PC like a public terminal.
✅ Do this instead
- Hardware wallet + verify on-deviceThe screen on the device is the only source of truth. Blind-signing still needs a sanity check.
- Separate machine for signingA cheap locked-down laptop that never visits GitHub or Discord. Air-gap the big stuff.
- Get software from the publisher’s official channel onlyChecksum + signature verify before installing. Search results are not vetted.
- Keep seed phrases offline, never in photos, notes, clipboard or cloudPaper + steel plate. That’s the whole game.
- Harden Windows: Defender on, RDP off, no unknown scheduled tasksHunt for odd SSH outbound, new “Remote Desktop Users”, and patched
termsrv.dll.
✅ Mark your defense checklist
🚨 I think I already pasted that command / entered my seed.
Speed is the only variable you control. The attacker’s bot moves in minutes, but funds sitting in a fresh, clean wallet are safe the moment the old one is drained-empty under your terms.
- Stop. Don’t finish the transfer.
Kill Wi-Fi, unplug the machine, but do not shut down yet if you need to read a balance — just isolate it.
- Grab a clean phone or a friend’s device
A never-infected browser. Restore nothing from this PC’s password manager or clipboard.
- Generate a brand-new wallet, on-device
Hardware wallet preferred. Write the new phrase on paper only. The old phrase is now public — treat it as burned.
- Sweep everything to the new wallet immediately
Use a high-but-fast fee. Double-check the destination on the device screen, not on the infected screen.
- Wipe & reinstall the PC, then rotate every credential
Exchange passwords, 2FA (use a fresh authenticator), API keys, GitHub PATs, SSH keys, password manager vault. Assume browser sessions are cloned.
- Report & preserve evidence
Save the fake page URL, repo, transaction hashes and file hashes. Hand them to your local cybercrime unit / exchange security team and your wallet vendor.
15 Jul 2026, campaign tracked since Jan 2026, precursors from 2025). Independent coverage: BleepingComputer, The Hacker News, HackRead, SecurityWeek. Kaspersky did not formally attribute the campaign; Russian-language code artifacts and CIS-geoblocked C2 servers are only indicators, not proof of actor identity. IoC list (hashes, domains, paths) is available in the full report.→ This page is an awareness aid, not a substitute for incident response. If assets are moving, contact your exchange and local authorities first.