OkoBot Malware Framework Targeting Cryptocurrency Wallets

Beginning in early 2026, researchers identified the 'OkoBot' campaign, a sophisticated multi-stage framework designed for the exfiltration of cryptocurrency assets and sensitive credentials. The campaign originates from malicious PowerShell scripts (TookPS) delivered via ClickFix attacks or poisoned GitHub repositories masquerading as legitimate software like SQL Server Management Studio. While no definitive attribution has been made, artifacts such as Russian-language code comments and the use of the Rilide extension suggest activity by Russian-speaking threat actors.

The framework is highly modular, utilizing an automated SSH bot for initial reconnaissance and persistence, followed by the deployment of specialized launchers (HDUtil) and plugin dispatchers (Volume2). These components orchestrate a suite of malicious modules including 'SeedHunter' for hardware wallet seed phrase theft, 'MC Keylogger' for clipboard and input monitoring, and 'OkoSpyware' for video capture of targeted wallet applications. The framework demonstrates high technical proficiency through its use of UAC bypassing via RPC, custom browser extension injection, and server-side geoblocking to avoid analysis in CIS regions.

This campaign poses a critical risk to individual cryptocurrency users and organizations managing digital assets. Its ability to remain hidden by patching browser processes and suppressing notifications, combined with its ongoing adaptation, indicates a persistent and evolving threat landscape.