Greed

2026

Elite

Read

Polymarket

<p><strong>Kaspersky has identified a malware framework targeting crypto investors, naming the threat OkoBot and warning that it bundles more than 20 payloads to steal wallets, credentials, and account access from users across dozens of countries.</strong></p>
<p>The security firm detailed the framework in a <a href="https://securelist.com/okobot-framework-targets-cryptocurrency-wallets/120660/" rel="noopener noreferrer nofollow">Securelist report published on July 15, 2026</a>, describing OkoBot as a modular toolkit that was still active at the time of writing and packs more than 20 malicious payloads and implants. For related coverage, see <a href="https://www.coinwy.com/us-regulator-withdraw-5-million-penalty-crypto-firm-trump-donors/" rel="noopener noreferrer nofollow">U.S. regulator seeks to withdraw $5 million penalty against crypto firm tied to Trump donors</a>.</p>
<div style="background:#eef4f7;border:1px solid #d7dbe0;border-radius:12px;padding:18px 22px;margin:24px 0;">
 <p style="margin:0 0 10px;font-weight:700;color:#101418;">Key Takeaways</p>
 <ul style="margin:0;color:#2b3640;">
  <li>Kaspersky identified OkoBot, a malware framework carrying more than 20 payloads aimed at cryptocurrency users.</li>
  <li>The campaign hit hundreds of victims across more than 25 countries, spreading through ClickFix lures and trojanized GitHub downloads.</li>
  <li>Its OkoSpyware module watches over 100 executable names, including wallet and password-manager apps, then records screen video and keystrokes.</li>
 </ul>
</div>
<h2 id="what-kaspersky-found-in-the-malware-framework">What Kaspersky Found in the Malware Framework</h2>
<p>OkoBot is not a single virus but a framework that chains together specialized modules for reconnaissance, surveillance, and theft. Kaspersky said the toolkit remained operational as its researchers published their findings. For related coverage, see <a href="https://www.coinwy.com/nikkei-sbi-rakuten-develop-in-house-crypto-investment-trusts/" rel="noopener noreferrer nofollow">Nikkei: SBI and Rakuten Develop In-House Crypto Investment Trusts</a>.</p>
<p>The company reported detecting hundreds of victims in more than 25 countries, with the largest share of attacked users in Brazil, Vietnam, Canada, Mexico, and Turkiye. That geographic spread points to a broad, opportunistic campaign rather than a narrowly regional one. For related coverage, see <a href="https://www.coinwy.com/reuters-iran-largest-crypto-exchange-elite-family/" rel="noopener noreferrer nofollow">Reuters: Iran's Largest Crypto Exchange Linked to Elite Family</a>.</p>
<figure style="margin:24px 0;padding:20px 22px;border:1px solid #d7dbe0;border-radius:14px;background:#f7f9fb;">
 <div style="font-family:Arial,sans-serif;font-size:12px;letter-spacing:0.08em;text-transform:uppercase;color:#5b6773;margin-bottom:8px;">
  Countries affected
 </div>
 <div style="font-family:Arial,sans-serif;font-size:44px;line-height:1;font-weight:700;color:#101418;margin:0 0 10px 0;">
  25+
 </div>
 <figcaption style="font-family:Arial,sans-serif;font-size:14px;line-height:1.5;color:#44515c;">
  Kaspersky reported OkoBot victims in more than 25 countries, indicating broad geographic reach for the campaign.
 </figcaption>
</figure>
<p>Kaspersky's security researcher Dmitry Galov said the OkoBot campaign had been active for more than a year and remained ongoing as of July 2026, according to the company's press release.</p>
<blockquote style="border-left:4px solid #26c6da;margin:20px 0;padding:8px 18px;color:#2b3640;font-style:italic; margin:20px 0; padding:16px 18px; border-left:4px solid #26c6da; background:#0d1519; color:#f3f4f6; border-radius:10px; margin:20px 0; padding:16px 18px; border-left:4px solid #26c6da; background:#0d1519; color:#f3f4f6; border-radius:10px">
 The OkoBot campaign has been active for more than a year and remained ongoing as of July 2026. <br><span style="font-size:13px;font-style:normal;color:#5b6773;">— Dmitry Galov, Kaspersky, <a href="https://www.kaspersky.com/about/press-releases/kaspersky-reveals-a-new-malicious-framework-targeting-cryptocurrency-users-with-the-use-of-okospyware" rel="noopener noreferrer nofollow">press release</a></span>
</blockquote>
<h2 id="how-the-threat-appears-to-target-crypto-investors">How the Threat Appears to Target Crypto Investors</h2>
<p>Initial infection commonly begins through ClickFix social-engineering attacks or GitHub-hosted malware posing as legitimate software, including a fake SQL Server Management Studio installer, Kaspersky said in its press release. Those lures put developers and crypto-curious users directly in the framework's path.</p>
<p>BleepingComputer independently confirmed the delivery vectors on July 16, 2026, <a href="https://www.bleepingcomputer.com/news/security/new-okobot-framework-deploys-20-payloads-to-steal-data-crypto/" rel="noopener noreferrer nofollow">reporting</a> that OkoBot reaches victims through ClickFix attacks or malicious GitHub repositories and summarizing SeedHunter, MC Keylogger, and OkoSpyware as key modules. The module names signal a clear focus on seed phrases and login credentials.</p>
<p>The framework's surveillance component, OkoSpyware, compiles a watchlist of over 100 executable names, including wallet and password-manager apps, then uses FFmpeg to record window video while logging keystrokes. That combination is designed to capture exactly the moment a user unlocks a wallet or reveals a recovery phrase.</p>
<figure style="margin:24px 0;padding:20px 22px;border:1px solid #d7dbe0;border-radius:14px;background:#fff8f1;">
 <div style="font-family:Arial,sans-serif;font-size:12px;letter-spacing:0.08em;text-transform:uppercase;color:#8a5a2b;margin-bottom:8px;">
  Monitored apps
 </div>
 <div style="font-family:Arial,sans-serif;font-size:44px;line-height:1;font-weight:700;color:#101418;margin:0 0 10px 0;">
  100+
 </div>
 <figcaption style="font-family:Arial,sans-serif;font-size:14px;line-height:1.5;color:#5f4a37;">
  Securelist said OkoSpyware compiled a watchlist of over 100 executable names to focus surveillance on wallet and credential-heavy applications.
 </figcaption>
</figure>
<p>Targeting apps and developer tools rather than a single exchange lets the operators harvest access wherever a victim stores value. That approach mirrors how manipulation campaigns lean on trusted personalities and platforms, a dynamic explored in coverage of <a href="https://www.coinwy.com/what-are-kols-in-crypto-and-why-do-they-matter/" rel="noopener noreferrer nofollow">the role of KOLs in shaping crypto behavior</a>.</p>
<h2 id="why-the-discovery-matters-for-the-crypto-market">Why the Discovery Matters for the Crypto Market</h2>
<p>Malware aimed at investors strikes at the trust retail participants place in wallets and exchanges, the very tools driving mainstream adoption. A framework that quietly records screens and keystrokes undermines the assumption that self-custody alone keeps funds safe.</p>
<p>The warning lands during a jittery market backdrop, with the <a href="https://alternative.me/crypto/fear-and-greed-index/" rel="noopener noreferrer nofollow">Fear &amp; Greed Index</a> reading 25, or "Extreme Fear," a sentiment level that leaves investors especially sensitive to security scares.</p>
<p>For platforms and wallet providers, OkoBot is another reminder that endpoint compromise can bypass exchange-side defenses entirely. The same trust question surfaces in reporting on how firms structure <a href="https://www.coinwy.com/nikkei-sbi-rakuten-develop-in-house-crypto-investment-trusts/" rel="noopener noreferrer nofollow">regulated crypto investment products</a> and how venues such as arbitrage-focused trading platforms onboard retail users.</p>
<p>OkoBot fits a recurring pattern of crypto-focused threats that follow the money as adoption grows. Kaspersky's disclosure gives users and defenders concrete indicators, from the modules involved to the GitHub and ClickFix delivery routes, to spot the campaign before funds move.</p>
<p style="font-size:13px;color:#888;border-top:1px solid #333;padding-top:12px;margin-top:30px;">Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.</p><a href="https://www.coinwy.com/?p=19598" rel="noopener noreferrer nofollow">Read original article on coinwy.com</a>
<div class="coinwy-read-also"><strong>Read also :</strong>
 <ul>
  <li><a href="https://www.coinwy.com/sec-charges-florida-man-company-22-million-crypto-mining-fraud/" rel="noopener noreferrer nofollow">SEC Charges Florida Man and Company Over Alleged $22M Crypto Mining Fraud</a></li>
  <li><a href="https://www.coinwy.com/trump-agrees-ethics-provision-crypto-bill-senate-vote/" rel="noopener noreferrer nofollow">Trump Agrees to Ethics Provision as Crypto Bill Nears Senate Vote</a></li>
  <li><a href="https://www.coinwy.com/sec-sues-mining-automatic-founder-22m-crypto-mining-scheme/" rel="noopener noreferrer nofollow">SEC Sues Mining Automatic Founder Over Alleged $22M Scheme</a></li>
  <li><a href="https://www.coinwy.com/mica-drives-70-of-binance-withdrawals-to-private-wallets/" rel="noopener noreferrer nofollow">MiCA Drives 70% of Binance Withdrawals to Private Wallets</a></li>
  <li><a href="https://www.coinwy.com/russias-state-duma-prepares-final-readings-on-crypto-bill/" rel="noopener noreferrer nofollow">Russia’s State Duma Prepares Final Readings on Crypto Bill</a></li>
 </ul>
</div>

Kaspersky Identifies Malware Framework Targeting Crypto Investors

Table of Contents

Coinwy

Other articles published on Jul 18, 2026

Join our free newsletter for daily crypto updates!