New malware platform steals crypto wallet seed phrases

Kaspersky’s Global Research and Analysis Team has uncovered OkoBot, a malware platform designed to target cryptocurrency wallet owners and steal seed phrases through phishing windows made to look like Trezor and Ledger interfaces.

The platform includes more than 20 modules that allow attackers to steal login credentials and wallet recovery phrases, silently install malicious browser extensions, monitor user activity, and carry out other malicious operations.

One of the newer components, OkoSpyware, can capture keystrokes and record video from the window of a targeted application. According to Kaspersky, the campaign has been active for more than a year and is still ongoing.

Attackers are using two main methods to infect victims:

• In one scenario, they rely on the ClickFix technique, tricking users into running malicious code themselves;
• In the other, they distribute malware through GitHub repositories disguised as legitimate software.

During its investigation, Kaspersky found a fake installer for SQL Server Management Studio, Microsoft’s widely used database management tool.

The SeedHunter module is responsible for targeting cryptocurrency wallets. It monitors systems for the official Trezor Suite, Ledger Wallet, and Ledger Live applications. If the malware detects a connected Trezor or Ledger hardware wallet, it displays a fake recovery page and asks the user to enter their seed phrase.

Kaspersky has recorded attempted infections involving hundreds of users across more than 25 countries. Brazil, Vietnam, Canada, Mexico, and Turkey have seen the highest number of cases.

The company believes developers and IT professionals may be among the campaign’s primary targets because they frequently use GitHub and specialized software tools.

Researchers have not attributed the attacks to a specific group. However, the techniques and information-stealing tools used in the campaign are common among Russian-speaking cybercriminals, and the technical analysis uncovered several Russian-language artifacts.