A sophisticated new cyber threat known as OkoBot is utilizing over 20 specialized payloads to hijack cryptocurrency seed phrases and sensitive user credentials.

Key Takeaways

  • OkoBot uses a multi-stage infection chain involving an SSH bot.
  • Over 20 distinct modules are used to steal data, including 'SeedHunter' for crypto wallets.
  • Attackers use fake GitHub repositories and 'ClickFix' methods to distribute malware.
  • Evidence suggests potential involvement of Russian-speaking threat actors.

The cybersecurity landscape has encountered a formidable new adversary in OkoBot, a highly sophisticated malicious framework designed for precision theft. According to recent findings by Kaspersky researchers, this framework is not a single-purpose tool but a modular arsenal capable of deploying more than 20 different payloads. Its primary objective is the extraction of cryptocurrency wallet seed phrases, browser cookies, and highly sensitive authentication credentials.

The Sophisticated Infection Vector

OkoBot employs deceptive tactics to bypass user suspicion. It frequently leverages ClickFix attacks or compromises GitHub repositories by masquerading as legitimate software. In a striking example of social engineering, attackers offered a fake version of SQL Server Management Studio (SSMS), which instead delivered a trojanized version of the Audacity audio tool. Once inside, the malware initiates a complex infection chain, starting with a PowerShell script that installs an SSH bot. This bot acts as a beachhead, gathering system intelligence—such as OS version and antivirus status—while simultaneously disabling Windows Defender notifications to remain undetected.

Specialized Modules: A Digital Heist Toolkit

What sets OkoBot apart is its modularity, allowing it to adapt to different high-value targets:

  • SeedHunter: This module specifically targets crypto enthusiasts by injecting itself into Trezor Suite and Ledger Live. It presents a fraudulent 'seed-recovery' screen, tricking users into handing over the master keys to their digital assets.
  • ext daemon/extl.exe: This component infiltrates Google Chrome to silently install malicious extensions like Rilide, which focus on stealing financial data and session cookies.
  • MC Keylogger & OkoSpyware: These modules provide comprehensive surveillance, recording keystrokes, capturing screenshots every five minutes, and even recording video of specific application windows to monitor password managers.

Geopolitical Clues and Global Reach

While the campaign has seen significant activity in Brazil, Vietnam, and Canada, the fingerprints of the attackers point toward a specific origin. Researchers noted that the command-and-control servers are geoblocked for Russian and CIS IP addresses. Furthermore, the presence of Russian comments within the SeedHunter source code suggests that the developers are likely Russian-speaking actors operating within invitation-only cybercrime forums. For crypto holders, the message is clear: once a seed phrase is compromised, the loss of funds is irreversible.