Malware
TookPS
- First Reported
- Jul 15, 2026
- Latest Reported
- Jul 16, 2026
Reported Context (3)
- Kaspersky says the campaign evolved from TookPS, uses multiple stages including an SSH bot, and has heavily targeted users in Brazil while remaining active globally. OkoBot Framework Uses 20+ Payloads to Target Credentials and Crypto Wallet Seeds
- #OkoBot OkoBot Uses In-App Fake Recovery Prompts to Target Ledger and Trezor Users
- Kaspersky identified the active OkoBot campaign, a multi-stage framework that uses TookPS, SSH tunneling, browser extension theft, keylogging, and spyware to steal cryptocurrency wallets and other credentials. OkoBot Malware Framework Targets Cryptocurrency Wallets
Malware (7)
MITRE ATT&CK (20)
Vendors (3)
Products (11)
Tools (2)
Industries (1)
Countries (6)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.