Kaspersky’s Global Research and Analysis Team has uncovered a sophisticated malware framework called OkoBot that delivers over 20 malicious payloads to steal cryptocurrency wallet seed phrases, browser credentials, and sensitive data. The campaign has been active for more than a year and remains ongoing, with hundreds of victims across more than 25 countries primarily in Brazil, Vietnam, Canada, Mexico, and Türkiye.
Moreover, the framework continues to evolve. In March 2026, researchers identified a new version that streamlined the infection chain and replaced earlier components with more capable modules. Consequently, OkoBot poses a growing threat to both individual cryptocurrency holders and software developers.
What Happened: OkoBot Malware Framework Targets Crypto Users with 20+ Payloads
In January 2026, Kaspersky GReAT analysts identified multiple attacks involving a previously unknown malware capable of capturing the contents of cryptocurrency wallet windows. During the investigation, they reconstructed the complete infection chain and named the campaign OkoBot.
The framework is an evolution of the TookPS campaign first discovered in March 2025. However, the attack chain was completely redesigned. TookPS now serves solely as the initial infection vector, while an automated SSH bot handles payload delivery, persistence, and data exfiltration.
OkoBot comprises more than 20 malicious implants covering a wide variety of functions. Furthermore, the framework includes specialized modules for harvesting cryptocurrency wallets, recording keystrokes, capturing video streams, and installing hidden browser extensions. The threat remains active as of July 2026.
Technical Details of the OkoBot Attack Chain
Initial Infection Vectors
OkoBot primarily reaches victims through two vectors. First, ClickFix attacks trick users into running malicious code via social engineering. Second, malware is distributed through GitHub repositories that masquerade as legitimate software. For example, one repository claimed to offer SQL Server Management Studio but actually delivered a trojanized version of Audacity with a malicious implant embedded in one of its libraries.
This fake repository was indexed by search engines and appeared at the top of results for SSMS queries. Therefore, it quickly earned users’ trust. The repository was created in March 2025 and remained active until June of that year.
SSH Bot and Back Connection
After initial infection, TookPS installs SSH on the victim’s system and establishes a connection to an attacker-controlled server. Subsequently, an automated SSH bot connects to the forwarded port and begins collecting system information. This includes usernames, installed antivirus software, IP address, and OS version.
The SSH bot also harvests cryptocurrency wallet files, browser cookies, profiles, and other credentials through the tunnel. In addition, it disables Windows Defender notifications via registry modification to evade detection.
The bot gains access to the graphical session using the following sequence:
- Opens firewall ports for inbound RDP traffic
- Creates a user in the Remote Desktop Users group
- Replaces the legitimate termsrv.dll with a patched version to permit multiple concurrent RDP sessions
- Creates a scheduled task named Apple Sync to maintain a reverse SSH tunnel that forwards the local RDP port every hour
Key Malicious Modules
The framework delivers more than 20 payloads via SFTP. The most notable modules include:
- ext daemon / extl.exe: A DLL injector that targets Chromium-based browsers to silently install and hide malicious extensions like Rilide, which targets credentials, cookies, financial information, and cryptocurrency data
- SeedHunter: Monitors Trezor Suite, Ledger Wallet, and Ledger Live applications and injects fake seed-recovery screens to steal wallet recovery phrases
- MC Keylogger: Records keystrokes and clipboard activity, including copied text, images, and file paths, and monitors USB connections while taking screenshots every five minutes
- OkoSpyware: Monitors approximately 100 programs including cryptocurrency wallets and password managers, uses FFmpeg to record video of their windows, and captures keystrokes
It is important to note that a wallet recovery phrase provides full access to a user’s cryptocurrency assets. If attackers obtain it, they can transfer funds to wallets they control with virtually no possibility of recovery.
Advanced Launcher and UAC Bypass
One deployed module is HDUtil, an auxiliary utility protected with VMProtect and heavily obfuscated. The most important command is target, which enables payload execution with an optional nouac argument for automatic UAC bypassing via Windows RPC and an auto-elevated msconfig.exe program.
This UAC bypass technique was discovered by Google’s Project Zero team in 2019. Therefore, it is a well-known method that still works effectively in modern Windows environments when paired with the right execution context.
Business and Operational Impact
OkoBot’s impact extends beyond individual cryptocurrency holders. The campaign specifically targets developers by distributing trojanized software through trusted platforms like GitHub. Therefore, organizations employing developers who download third-party tools face supply-chain risk.
The real-world consequences include:
- Financial losses: Stolen cryptocurrency wallet seed phrases lead to irreversible fund transfers
- Credential exposure: Browser credentials, cookies, and password manager vaults are harvested for account takeover
- Data theft: Screenshots, clipboard contents, and keystrokes expose sensitive business information
- Persistent access: SSH tunnels and RDP backdoors allow attackers to maintain long-term access to compromised systems
- Reputational damage: Developers distributing compromised tools may inadvertently expose their organizations and clients
Mitigation and Recommendations
Immediate Actions for Defenders
- Monitor for unusual SSH connections and RDP sessions, especially those originating from unexpected remote hosts
- Audit GitHub repositories and software downloads against known checksums to detect trojanized tools
- Review firewall rules for unexpected inbound RDP traffic and unknown users in the Remote Desktop Users group
- Check for scheduled tasks named Apple Sync or similar suspicious entries that maintain persistent tunnels
- Inspect browser extensions for unknown or hidden entries, particularly those targeting cryptocurrency wallets
Prevention for Users
- Never follow instructions from unverified sources to deploy unknown code on a device
- Use a strong endpoint security solution on all computers and mobile devices
- Avoid storing passwords or recovery phrases in photo galleries or notes; use a dedicated password manager
- Never disable antivirus or security tools to install software
- Exercise caution when downloading game mods, cheats, or third-party utilities
- Keep operating systems and applications updated, use strong unique passwords, and enable multi-factor authentication wherever possible
Bottom line: OkoBot is a mature, actively maintained framework that combines social engineering, supply-chain deception, and advanced persistence to steal cryptocurrency and credentials. Organizations and individuals alike should treat software downloads from untrusted repositories with extreme caution and monitor for signs of SSH tunneling and unauthorized RDP access.
Incident Summary
| Malware Framework: | OkoBot (evolution of TookPS campaign) |
| First Observed: | March 2025 (TookPS); January 2026 (OkoBot identified) |
| Affected Platforms: | Windows (primary), Chromium-based browsers |
| Primary Targets: | Cryptocurrency users, software developers |
| Geographic Reach: | 25+ countries; highest in Brazil, Vietnam, Canada, Mexico, Türkiye |
| Payload Count: | 20+ malicious modules |
| Key Modules: | SeedHunter, OkoSpyware, MC Keylogger, Rilide stealer, TeviRAT backdoor |
| Disclosure Date: | July 2026 (Kaspersky GReAT report) |
| Patch Status: | No single patch available; mitigation relies on behavioral defenses and user awareness |
| Threat Status: | Active and evolving |
References
- Kaspersky GReAT, “OkoBot: new sophisticated malware framework targets cryptocurrency users,” Securelist, July 2026, https://securelist.com/okobot-framework-targets-cryptocurrency-wallets/120660/, accessed July 16, 2026
- Kaspersky, “Kaspersky reveals a new malicious framework targeting cryptocurrency users with the use of OkoSpyware,” Press Release, July 2026, https://www.kaspersky.com/about/press-releases/…, accessed July 16, 2026
- Bill Toulas, “New OkoBot framework deploys 20 payloads to steal data, crypto,” BleepingComputer, July 16, 2026, https://www.bleepingcomputer.com/news/security/new-okobot-framework-deploys-20-payloads-to-steal-data-crypto/, accessed July 16, 2026
- Google Project Zero, “Calling local Windows RPC servers from Python,” December 2019, https://googleprojectzero.blogspot.com/2019/12/calling-local-windows-rpc-servers-from.html, accessed July 16, 2026
