Technology and Science19 July, 20262 min read
Kaspersky Identifies OkoBot Malware Framework Targeting Cryptocurrency Investors by Stealing Wallet Files
This article is an automated aggregation of coverage from news outlets. Our editorials offer in-depth analysis curated by the NewsCord team.
Kaspersky identifies OkoBot framework targeting crypto wallet users, stealing seed phrases and credentials. SeedHunter module targets Ledger and Trezor wallets via phishing pages.
OkoBot targets crypto wallets
Kaspersky has identified a malware framework called OkoBot that targets cryptocurrency investors by stealing wallet files and account information, with Cointelegraph reporting on July 18 that the malware is spread using social engineering techniques and trojanised GitHub apps. Kaspersky said OkoBot uses tactics such as “ClickFix” in the early stages of infection to induce users to execute malicious commands themselves, and it also installs a backdoor through a GitHub app disguised as legitimate software.
Kaspersky said it confirmed cases in which the malware family has been used in multiple attacks since January 2026, and it can collect cryptocurrency wallet files, browser data and user credentials. The attack aims to infect devices by planting a remote access trojan, and attackers can use this to steal project keys, cloud credentials and wallet extension data.
Modules, victims, and reach
Crypto Briefing says Kaspersky’s OkoBot framework targets crypto users by stealing wallet seed phrases, credentials and other sensitive data through a collection of more than 20 malicious components. That same report says the campaign was first identified in January 2026 and has compromised hundreds of victims across more than 25 countries, naming Brazil, Vietnam, Canada, Mexico and Türkiye among the most affected.
Crypto Briefing adds that researchers found attackers distribute the malware through ClickFix social engineering schemes and fake software downloads hosted on GitHub, enabling the framework to infect devices and deploy additional malware, including the Rilide browser stealer. It also describes OkoBot’s components as including TookPS, which exfiltrates wallet seed phrases, OkoSpyware, which monitors Chromium-based browsers and records user activity, and SeedHunter, which injects malicious code into Trezor and Ledger wallet software to display phishing pages requesting recovery phrases.
Telegram session hijacking risk
Separately, SlowMist warned Apple users about a macOS malware campaign capable of hijacking Telegram sessions and stealing cryptocurrency wallet data, scanning infected macOS devices for Telegram session files, authentication tokens, browser credentials and cryptocurrency wallet information stored locally on the system. Global Crypto says attackers can use stolen Telegram sessions to gain immediate access to private chats, trading groups, over the counter negotiations, token launch discussions and project administration channels without triggering traditional login verification systems.
The report frames the stakes as financial and operational risks for cryptocurrency firms and individual investors alike, and it says Telegram session hijacking creates new risks for crypto users. Cointelegraph also reported that SlowMist warned of a separate malware campaign targeting macOS users, aiming to steal their credentials and hijack their Telegram sessions to ultimately trick investors into entering their wallet recovery phrases through fake websites.