Evolution

<p>The cryptocurrency sector continues to attract cybercriminals, who perfect their methods to deceive their victims. This time, Kaspersky highlights a new malware framework designed to compromise digital wallets and steal sensitive data. Analysis shows attackers combine social engineering, fake GitHub projects, and remote access techniques to infiltrate devices. Meanwhile, another campaign targets Web3 developers through fake job offers posted on LinkedIn, revealing an evolution of threats.</p>
<div class="in-brief">
 <div class="in-brief--container"><span></span><span></span>
  <h2 class="in-brief--title" id="in-brief">In brief</h2>
  <ul>
   <li>Kaspersky identified OkoBot, a new malware framework targeting cryptocurrency investors since January 2026.</li>
   <li>The malware uses social engineering, ClickFix, and fake GitHub repositories to compromise victims’ devices.</li>
   <li>Once installed, OkoBot can steal crypto wallet files, user credentials, and browsing data.</li>
   <li>Meanwhile, SlowMist alerts about a separate campaign trapping Web3 developers through fake job offers on LinkedIn.</li>
  </ul>
 </div>
</div>
<h2 id="h-kaspersky-unveils-the-operation-of-the-okobot-malware">Kaspersky Unveils the Operation of the OkoBot Malware</h2>
<p>According to the <a href="https://www.cointribune.com/en/search/Cybersecurity/" rel="noopener noreferrer nofollow">cybersecurity</a> company Kaspersky, the new malicious framework, named OkoBot, relies on a carefully prepared infection chain. Attackers notably use social engineering techniques such as ClickFix to convince their targets to execute malicious commands. They also distribute fake applications hosted on GitHub to introduce a backdoor on compromised devices.</p>
<div class="my-4">
 <div class="ads "></div>
</div>
<p>Once installed, the malware collects several types of sensitive data. It can retrieve cryptocurrency wallet files, user credentials, as well as browsing information. It also injects malicious extensions into the browser and captures wallet application windows to facilitate the theft of digital assets.</p>
<p>Kaspersky indicates in its <a href="https://llkl-www.kaspersky.com.tr/about/press-releases/kaspersky-reveals-a-new-malicious-framework-targeting-cryptocurrency-users-with-the-use-of-okospyware?utm_source=chatgpt.com" rel="noopener noreferrer nofollow">report</a> that it has observed several attacks using this malware family since January 2026. The company also specifies that this new threat comes from the evolution of TookPS, a campaign detected in 2025 that already distributed a Trojan through fake software download sites.</p>
<div class="affiliate-button"><a href="https://kraken.pxf.io/K0XRaaes" rel="noopener noreferrer nofollow">Start your crypto adventure safely with Kraken</a><a href="https://www.cointribune.com/en/sponsored-content/" rel="noopener noreferrer nofollow">This link uses an affiliate program.</a>
</div>
<h2 id="h-a-technical-evolution-that-strengthens-attackers-capabilities">A Technical Evolution That Strengthens Attackers’ Capabilities</h2>
<p><a href="https://cointelegraph.com/news/kaspersky-malware-framework-crypto-investors?utm_campaign=rss_partner_inbound&amp;utm_medium=rss&amp;utm_source=rss_feed" rel="noopener noreferrer nofollow">The new framework</a> presents a significant difference compared to previous campaigns. According to Kaspersky, the twenty malicious payloads are orchestrated through an SSH tunnel. This method allows attackers to remotely transfer data collected from infected computers to their own infrastructures.</p>
<p>This architecture also facilitates imitation attacks. Cybercriminals can thus adapt their operations and maintain discreet communication with compromised machines. This technical evolution illustrates the growing sophistication of tools used against cryptocurrency investors.</p>
<p>However, infection methods rely on an identical principle. Victims are first led to trust an application or procedure that appears legitimate. They then perform actions themselves that open the door to malware, making attack detection more difficult.</p>
<h2 id="h-web3-developers-also-targeted-by-fake-linkedin-offers">Web3 Developers Also Targeted by Fake LinkedIn Offers</h2>
<p>Meanwhile, according to <a href="https://slowmist.medium.com/threat-intelligence-analysis-of-a-github-poisoning-attack-disguised-as-recruitment-30fe23601305" rel="noopener noreferrer nofollow">observations</a> from the blockchain and Web cybersecurity company SlowMist, a separate campaign targets Web3 developers. Attackers contact their victims on LinkedIn posing as blockchain recruitment specialists. They then send fake GitHub repositories presented as projects to test before a job interview.</p>
<p>The scenario mimics the usual steps of a technical interview. Developers download the code, install dependencies, then launch the project without suspecting the presence of malware. Once active, it deploys a remote access Trojan capable of stealing project keys, cloud credentials, or wallet extension data.</p>
<p>SlowMist emphasizes that this method is not an isolated incident. Cybercriminals now exploit recruitment contexts, code reviews, or collaboration to push their targets to execute malicious repositories. Kaspersky and SlowMist describe different approaches but based on the same goal: gaining access to sensitive data of crypto ecosystem actors.</p>
<div class="my-4">
 <div class="ads "></div>
</div>
<p>These publications show that malicious campaigns evolve rapidly and increasingly rely on credible interactions with their victims. They also confirm that crypto investors as well as <a href="https://www.cointribune.com/en/tag/web-3-0-en/" rel="noopener noreferrer nofollow">Web3</a> developers remain preferred targets, while social engineering techniques continue to play a central role in observed attacks.</p>

Kaspersky Uncovers a New Malware Capable of Stealing Your Digital Assets

Table of Contents

Cointribune EN

Other articles published on Jul 20, 2026

Join our free newsletter for daily crypto updates!