OkoBot Framework Uses 20+ Payloads to Target Credentials and Crypto Wallet Seeds
Summary
Kaspersky says OkoBot uses ClickFix attacks and fake GitHub repositories to deliver more than 20 payloads targeting credentials, cookies, and crypto wallet seed phrases. The campaign evolved from TookPS and has heavily targeted Brazil.
Key points
- Kaspersky says OkoBot has been active for more than a year and evolved from TookPS, with a changed, multi-stage infection chain.
- Delivery methods include ClickFix attacks and fake GitHub repositories; one repository posing as an SSMS tool delivered a trojanized Audacity installer.
- An SSH bot gathers system details, harvests wallet files, browser cookies, and credentials, and disables Windows Defender notifications.
- SeedHunter injects into Trezor Suite, Ledger Wallet, and Ledger Live to display fake recovery screens aimed at stealing wallet seed phrases.
- Other described modules include a Chrome extension installer, a keylogger, and spyware that records selected program windows.
- Kaspersky telemetry places most victims in Brazil, followed by Vietnam, Canada, Mexico, and Turkey; the campaign has global reach.
- Kaspersky does not attribute the campaign to a threat actor; Russian-language code comments and other clues are cited, but attribution remains uncertain.
Article Details
- Event Type
- Malware campaign using the OkoBot framework, ClickFix attacks, and fake GitHub repositories to deliver data-stealing payloads.
- Impact
- The payloads can steal cryptocurrency wallet recovery phrases, credentials, browser cookies, and system information. The SSH bot also collects wallet files, while other modules record keystrokes, clipboard activity, and screenshots. Stolen recovery phrases could let attackers transfer victims’ cryptocurrency.
MITRE ATT&CK
T1056.001 · KeyloggingMC Keylogger records keystrokes and clipboard activity.T1059.001 · PowerShellThe article says the earlier TookPS activity involved a malicious PowerShell script used in the initial attack stage.T1113 · Screen CaptureMC Keylogger takes screenshots, and OkoSpyware records video of program windows.
Malware
MC KeyloggerMC Keylogger: Records keystrokes and clipboard activity, including copied text, images, and file paths, and can also monitor for USB connections and take screenshots every 5 minutes.OkobotOkoBot is a malicious framework that uses ClickFix attacks and fake GitHub software repositories to deliver more than 20 payloads aimed at stealing cryptocurrency wallet seed phrases, credentials, and other sensitiveOkoSpywareOkoSpyware: Monitors 100 programs like cryptocurrency wallets and password managers, and uses FFmpeg to record video of their windows and also capture keystrokes.Rilide#OkoBotSeedHunter#OkoBotTookPSKaspersky says the campaign evolved from TookPS, uses multiple stages including an SSH bot, and has heavily targeted users in Brazil while remaining active globally.
Products
AudacityIn one case, a repository claimed to offer SQL Server Management Studio (SSMS) but dropped a trojanized version of the Audacity audio editing tool.GitHubOkoBot is a malicious framework that uses ClickFix attacks and fake GitHub software repositories to deliver more than 20 payloads aimed at stealing cryptocurrency wallet seed phrases, credentials, and other sensitiveLedger LiveSeedHunter: Injects into Trezor Suite, Ledger Wallet, and Ledger Live to display a fake seed-recovery screen designed to steal wallet recovery phrases from victims.Ledger WalletSeedHunter: Injects into Trezor Suite, Ledger Wallet, and Ledger Live to display a fake seed-recovery screen designed to steal wallet recovery phrases from victims.SQL Server Management StudioIn one case, a repository claimed to offer SQL Server Management Studio (SSMS) but dropped a trojanized version of the Audacity audio editing tool.Trezor SuiteSeedHunter: Injects into Trezor Suite, Ledger Wallet, and Ledger Live to display a fake seed-recovery screen designed to steal wallet recovery phrases from victims.Windows DefenderThe SSH bot is also responsible for collecting system details (username, antivirus software, IP address, OS version) and disabling Windows Defender notifications.
Countries
BrazilKaspersky says the campaign evolved from TookPS, uses multiple stages including an SSH bot, and has heavily targeted users in Brazil while remaining active globally.CanadaKaspersky telemetry shows that the majority of OkoBot’s victims are located in Brazil, followed by Vietnam, Canada, Mexico, and Turkey.MexicoKaspersky telemetry shows that the majority of OkoBot’s victims are located in Brazil, followed by Vietnam, Canada, Mexico, and Turkey.TurkeyKaspersky telemetry shows that the majority of OkoBot’s victims are located in Brazil, followed by Vietnam, Canada, Mexico, and Turkey.VietnamKaspersky telemetry shows that the majority of OkoBot’s victims are located in Brazil, followed by Vietnam, Canada, Mexico, and Turkey.