OkoBot is a multi-stage malware framework that deploys more than 20 payloads to steal cryptocurrency wallet recovery phrases, credentials, and other sensitive information. It initially infects victims through ClickFix attacks or malicious GitHub repositories distributing trojanized software. The infection chain begins with a PowerShell script (TookPS) that installs an SSH bot responsible for system reconnaissance and disabling Windows Defender notifications. Notable payloads include browser injectors that silently install malicious extensions, modules that fake seed recovery screens for hardware wallets like Trezor and Ledger, keyloggers capturing keystrokes and clipboard data, and spyware that records video of targeted applications. The campaign has been ongoing since March 2025 and shows geoblocking of IPs from Russia and CIS countries, with Russian-language code comments suggesting a Russian-speaking threat actor. Kaspersky provides indicators of compromise including hashes, file paths, domains, and IP addresses. There is no vendor advisory or patch information available.

The OkoBot framework enables attackers to steal cryptocurrency wallet seed phrases, which grant full access to victims' cryptocurrency assets, allowing irreversible theft. It also compromises credentials, browser cookies, and other sensitive data, potentially leading to broader account takeovers and financial losses. The malware disables Windows Defender notifications, reducing the likelihood of detection. The campaign affects users globally, with a concentration in Brazil, Vietnam, Canada, Mexico, and Turkey. The multi-stage infection and variety of payloads increase the complexity and effectiveness of the attacks.

No official patch or remediation is currently available for OkoBot. Security teams should rely on the indicators of compromise published by Kaspersky to detect and block infections. Since the malware disables Windows Defender notifications, additional endpoint detection and response (EDR) solutions and network monitoring may help identify suspicious activity. Users should avoid downloading software from untrusted sources, especially trojanized repositories on GitHub, and be cautious of unsolicited links or ClickFix attacks. Regular backups and strong multi-factor authentication for cryptocurrency wallets are recommended to mitigate potential losses.