Greed

Cryptocurrency

Citadel

Million

Read

<p><strong>Kaspersky has exposed OkoBot, a modular malware framework built from more than 20 malicious payloads that targets cryptocurrency wallets, tricking users into surrendering the seed phrases that control their funds.</strong></p>
<h2 id="what-kaspersky-says-it-found-about-okobot">What Kaspersky Says It Found About OkoBot</h2>
<p>Kaspersky researchers published their technical analysis of the OkoBot framework on July 15, 2026, warning that the threat was still active at the time of writing and that the campaign had been running for over a year, <a href="https://securelist.com/okobot-framework-targets-cryptocurrency-wallets/120660/" rel="noopener noreferrer nofollow">according to its Securelist report</a>. For related coverage, see <a href="https://www.coinlineup.com/citadel-backs-two-crypto-exchanges-with-600-million/" rel="noopener noreferrer nofollow">Citadel Backs Two Crypto Exchanges With $600 Million Investment</a>.</p>
<p>The framework is not a single virus but a toolkit of more than 20 malicious payloads and implants assembled to steal data and drain crypto wallets. For related coverage, see <a href="https://www.coinlineup.com/citadel-securities-invests-400-million-in-crypto-com-at-20-billion-valuation/" rel="noopener noreferrer nofollow">Citadel Securities Invests $400M in Crypto.com at $20B Valuation</a>.</p>
<figure style="margin:24px 0">
 <div style="border:1px solid #d7dde5;border-radius:10px;padding:20px;background:#f6f8fb;text-align:center">
  <div style="font-size:13px;letter-spacing:0.08em;text-transform:uppercase;color:#5b6472;margin-bottom:8px">
   OkoBot payloads
  </div>
  <div style="font-size:44px;line-height:1;font-weight:700;color:#101828;margin-bottom:10px">
   20+
  </div>
  <figcaption style="color:#475467;font-size:14px;line-height:1.5">
   Kaspersky said the framework includes more than 20 malicious payloads and implants. Source: Securelist
  </figcaption>
 </div>
</figure>
<p>One module, named SeedHunter, injects itself into Trezor Suite, Ledger Wallet, and Ledger Live, then displays phishing seed-recovery pages designed to capture the recovery phrases of hardware wallet owners. For related coverage, see <a href="https://www.coinlineup.com/esma-adds-14-crypto-firms-ripple-payments-europe-mica-register/" rel="noopener noreferrer nofollow">ESMA Adds 14 Crypto Firms, Including Ripple Payments Europe, to MiCA Register</a>.</p>
<p>Dmitry Galov of Kaspersky described the scale of the operation directly.</p>
<blockquote style="border-left:4px solid #29b6f6;margin:20px 0;padding:12px 20px;color:#333;margin:20px 0;padding:16px 18px;border-left:4px solid #29b6f6;background:#0d1319;color:#f3f4f6;border-radius:10px;margin:20px 0;padding:16px 18px;border-left:4px solid #29b6f6;background:#0d1319;color:#f3f4f6;border-radius:10px">
 The OkoBot campaign has been active for more than a year and remained ongoing as of July 2026. <a href="https://www.kaspersky.com/about/press-releases/kaspersky-reveals-a-new-malicious-framework-targeting-cryptocurrency-users-with-the-use-of-okospyware" rel="noopener noreferrer nofollow">— Dmitry Galov, Kaspersky</a>
</blockquote>
<h2 id="why-the-20-module-design-stands-out">Why the 20-Module Design Stands Out</h2>
<p>A modular architecture lets attackers mix and match functions per victim, deploying only the implants they need and swapping components as defenders catch on. That flexibility makes such frameworks harder to detect and contain than a single-purpose stealer.</p>
<p>OkoSpyware, another component in the chain, monitors 100 programs including crypto wallets and password managers, records video with FFmpeg, and captures keystrokes, <a href="https://www.bleepingcomputer.com/news/security/new-okobot-framework-deploys-20-payloads-to-steal-data-crypto/" rel="noopener noreferrer nofollow">BleepingComputer reported</a>.</p>
<p>The framework reaches victims through ClickFix social-engineering attacks and fake GitHub repositories, including a trojanized Audacity package disguised as SQL Server Management Studio. Kaspersky said it detected hundreds of victims across more than 25 countries.</p>
<figure style="margin:24px 0">
 <div style="border:1px solid #d7dde5;border-radius:10px;padding:20px;background:#fff8f1;text-align:center">
  <div style="font-size:13px;letter-spacing:0.08em;text-transform:uppercase;color:#8a4b14;margin-bottom:8px">
   Countries affected
  </div>
  <div style="font-size:44px;line-height:1;font-weight:700;color:#7a2e0e;margin-bottom:10px">
   25+
  </div>
  <figcaption style="color:#7a3e12;font-size:14px;line-height:1.5">
   Kaspersky said it detected hundreds of victims in more than 25 countries. Source: Securelist
  </figcaption>
 </div>
</figure>
<p>Brazil, Vietnam, Canada, Mexico, and Turkiye were the most affected markets, showing the campaign was not confined to a single region. According to unconfirmed reports, technical clues such as geoblocking and Russian-language code comments point to a Russian-speaking operator, though Kaspersky said it cannot attribute the campaign with high confidence.</p>
<h2 id="what-the-okobot-wallet-threat-means-for-crypto-users">What the OkoBot Wallet Threat Means for Crypto Users</h2>
<p>The core danger is the seed phrase. Because SeedHunter renders its phishing prompts inside legitimate wallet software, the usual advice to check the browser address bar offers little protection; a recovery phrase entered into any prompt, even one that appears within a trusted app, can hand an attacker full control of the wallet.</p>
<p>The incident lands during a nervous stretch for the market. The <a href="https://alternative.me/crypto/fear-and-greed-index/" rel="noopener noreferrer nofollow">Fear &amp; Greed Index</a> reads 25, or "Extreme Fear," while Bitcoin trades near <a href="https://www.coingecko.com/" rel="noopener noreferrer nofollow">$64,123</a> after a 1.9% daily gain.</p>
<p>Self-custody guidance from wallet makers is consistent: recovery phrases should never be typed into online forms or software prompts, a point Trezor reiterated in its own <a href="https://blog.trezor.io/trezor-security-alert-stay-vigilant-against-an-unauthorized-email-and-continued-phishing-attacks-1b4982c2f53c" rel="noopener noreferrer nofollow">phishing security alert</a>.</p>
<p>The threat is broad because it targets wallet users across assets rather than one token, a reminder that operational security matters even as institutional interest keeps building through vehicles like the <a href="https://www.coinlineup.com/t-rowe-price-launches-tknz-active-crypto-etf/" rel="noopener noreferrer nofollow">T. Rowe Price TKNZ active crypto ETF</a> and asset managers <a href="https://www.coinlineup.com/1-9-trillion-asset-manager-tests-demand-for-crypto-basket-etfs/" rel="noopener noreferrer nofollow">testing demand for crypto basket ETFs</a>. New capital entering the sector expands the pool of holders that campaigns like OkoBot aim to exploit.</p>
<p style="font-size:13px;color:#888;border-top:1px solid #333;padding-top:12px;margin-top:30px">Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.</p><a href="https://www.coinlineup.com/?p=28225" rel="noopener noreferrer nofollow">Read original article on coinlineup.com</a>

Kaspersky Exposes OkoBot's 20-Module Crypto Wallet Attack

Table of Contents

Coinlineup.com

Other articles published on Jul 18, 2026

Join our free newsletter for daily crypto updates!