The OkoBot malware framework uses a complex infection chain starting with TookPS PowerShell scripts delivered through ClickFix attacks or fake GitHub software. An automated SSH bot deploys multiple malicious modules such as HDUtil launcher, browser extension injectors that install the Rilide stealer, SeedHunter for wallet seed phrase theft, and OkoSpyware for window capture. The framework employs VMProtect obfuscation and UAC bypass techniques to evade detection and maintain persistence through RDP access and scheduled tasks. The campaign targets cryptocurrency users and has affected victims in over 25 countries, notably Brazil, Vietnam, Canada, Mexico, and Turkey. Russian language artifacts and geoblocking patterns suggest Russian-speaking threat actors.

The malware framework enables theft of cryptocurrency wallet seed phrases and other sensitive data, compromising victims' cryptocurrency holdings. It achieves persistence and stealth through obfuscation and UAC bypass, increasing the difficulty of detection and removal. The broad geographic distribution of victims indicates a widespread campaign with potential significant financial losses for affected users.

No official patch or fix is available for this malware framework. Mitigation should focus on preventing initial infection by avoiding execution of untrusted PowerShell scripts and fake software, especially from GitHub or suspicious domains. Monitoring for unusual SSH and RDP activity and removing unauthorized scheduled tasks can help limit persistence. Use endpoint protection solutions capable of detecting obfuscated malware and browser extension injectors. Refer to vendor advisories and threat intelligence sources for updated detection signatures and mitigation techniques.