OkoBot: Multi-Stage Malware Framework Targeting Cryptocurrency Wallets (TookPS/HDUtil/Volume2/SeedHunter)
OkoBot: Multi-Stage Malware Framework Targeting (TL-2026-1363), also tracked as OkoBot Framework, is a critical-severity malware campaign, first published 2026-07-15. It is linked to a Russia-nexus actor with low confidence, affects Trezor Trezor Suite, maps to 33 MITRE ATT&CK techniques (T1016, T1027.002, T1036.005), and is covered by 9 detection rules and 45 indicators of compromise.
Key facts for TL-2026-1363
- Threat ID
- TL-2026-1363
- Also known as
- OkoBot Framework, TookPS Campaign
- Severity
- CRITICAL
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-07-15
- Last reviewed
- 2026-07-15
- Attribution confidence
- LOW
- Nation-state nexus
- Russia
- Motivation
- FINANCIAL
- Target sectors
- cryptocurrency, finance, individual-consumers, fintech
- Target regions
- brazil, vietnam, canada, mexico, Turkiye, Latin America, North America, Southeast Asia
- Detection rules
- 9
- Indicators of compromise
- 45
Malware and tooling in OkoBot: Multi-Stage Malware Framework Targeting
Malware and tooling: OkoBot, Rilide, TeviRAT, TookPS, HDUtil, MC Keylogger, OkoSpyware, SeedHunter, Volume2 (trojanized)
Kaspersky Securelist details OkoBot, a modular Windows infection chain (TookPS downloader, HDUtil launcher, Volume2 plugin dispatcher, SeedHunter, MC Keylogger, OkoSpyware) that harvests browser data, wallet seed phrases, and credentials from Trezor Suite, Ledger Wallet/Live, Exodus, and Litecoin QT. The campaign has run since March 2025, infecting hundreds of victims across 25+ countries.
How OkoBot: Multi-Stage Malware Framework Targeting works
OkoBot is a modular cryptocurrency-theft framework tracked by Kaspersky since a March 2025 TookPS downloader campaign. Initial access is achieved via ClickFix social-engineering lures and trojanized software distributed through GitHub, most notably a legitimate copy of Audacity recompiled with a malicious implant and repackaged to impersonate SQL Server Management Studio (SSMS) so it surfaces in search-engine results. TookPS is a malicious PowerShell downloader (detected by Kaspersky as Trojan-Downloader.Win32.TookPS) that establishes outbound SSH connections, forwards SSH daemon ports, and schedules tasks (including a persistence task named 'Apple Sync' that re-establishes a reverse SSH tunnel hourly) to pull down further payloads and exfiltrate data over SFTP.
In the April 2025 redesign, TookPS delivers HDUtil, a VMProtect-packed auxiliary launcher retrieved over SFTP. HDUtil enumerates the host (active sessions, graphics adapters) and executes further modules via a 'target' command. It performs privilege escalation using a 2019 Project Zero-documented UAC bypass abusing Windows RPC and the auto-elevated msconfig.exe binary, and can enable RDP access by modifying the firewall, adding accounts to the Remote Desktop Users group, and patching termsrv.dll to allow concurrent RDP sessions. Each infected host is fingerprinted using an MD5 HWID hash cached at %PROGRAMDATA%\hwid.dat, which also doubles as the RC4 key used to encrypt exfiltrated wallet seed-phrase backups.
By March 2026 the actor streamlined the chain: TookPS and HDUtil were dropped in favor of deploying Volume2 directly. Volume2 is a legitimate open-source volume-control utility whose DLL search order is hijacked with a malicious protobuf.dll (later renamed version.dll) that acts as the framework's plugin dispatcher. It decrypts and loads implants using AES-GCM, then communicates outbound over HTTP with AES-CBC-encrypted JSON, polling its C2 roughly every 20 seconds for tasking.
Volume2 injects several second-stage implants into legitimate processes: ext_daemon, a browser-extension loader functionally identical to extl.exe that installs a malicious extension (associated with the Rilide family, advertised on Russian-language cybercrime forums) into Chromium-based browsers (Chrome, Edge, Brave) to steal session data and credentials; SeedHunter, which specifically targets Trezor Suite and Ledger Wallet/Live desktop applications plus Exodus and Litecoin QT to locate and exfiltrate wallet seed phrases and keystore material; MC Keylogger, which captures keystrokes, clipboard contents, connected USB device metadata, and periodic screenshots; and OkoSpyware, which uses a bundled FFmpeg binary to record screen video and keystrokes specifically while cryptocurrency wallet applications or KeePassXC/1Password password-manager windows are in focus. Exfiltrated artifacts (keylogs, screenshots, video recordings) are uploaded via HTTP POST to an ir-post.php endpoint on operator infrastructure.
Infrastructure is geoblocked so victim traffic originating from Russia and CIS countries is rejected, and SeedHunter's source contains Russian-language developer comments, together suggesting a Russian-speaking threat actor; Kaspersky stops short of formal attribution to a named group. Victims cluster heavily in Brazil, Vietnam, Canada, Mexico, and Turkiye, with hundreds of confirmed infections across more than 25 countries during the January-June 2026 active phase.
MITRE ATT&CK techniques used in TL-2026-1363
Discovery
T1016 System Network Configuration Discovery; T1082 System Information Discovery; T1120 Peripheral Device Discovery
Defense Evasion
T1027.002 Software Packing; T1036.005 Match Legitimate Resource Name or Location; T1140 Deobfuscate/Decode Files or Information; T1574.001 DLL
Exfiltration
T1041 Exfiltration Over C2 Channel; T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol
Execution
T1053.005 Scheduled Task; T1059.001 PowerShell; T1059.003 Windows Command Shell
Persistence
T1053.005 Scheduled Task; T1133 External Remote Services; T1136.001 Local Account; T1176 Software Extensions
Privilege Escalation
T1055 Process Injection; T1548.002 Bypass User Account Control
Credential Access
T1056.001 Keylogging; T1555.003 Credentials from Web Browsers; T1555.005 Password Managers
Command and Control
T1071.001 Web Protocols; T1219 Remote Access Tools; T1572 Protocol Tunneling; T1573.001 Symmetric Cryptography
Collection
T1074 Data Staged; T1113 Screen Capture; T1115 Clipboard Data; T1125 Video Capture
Initial Access
T1189 Drive-by Compromise; T1566 Phishing
defense-impairment
T1601.001 Patch System Image; T1686 Disable or Modify System Firewall
Impact
Affected products and versions in OkoBot: Multi-Stage Malware Framework Targeting
- Trezor — Trezor Suite
Vulnerable versions: all versions targeted via credential/seed theft, not a software vulnerability - Ledger — Ledger Wallet / Ledger Live
Vulnerable versions: all versions targeted via credential/seed theft, not a software vulnerability - Exodus — Exodus Wallet
Vulnerable versions: all versions targeted via credential/seed theft, not a software vulnerability - Litecoin — Litecoin QT
Vulnerable versions: all versions targeted via credential/seed theft, not a software vulnerability - Microsoft — Windows (msconfig.exe UAC auto-elevation)
Vulnerable versions: Windows 10/11 builds where the 2019 msconfig.exe RPC auto-elevation UAC bypass remains unmitigated - Various — Volume2 (legitimate open-source utility, DLL-hijacked)
Vulnerable versions: installations susceptible to protobuf.dll/version.dll search-order hijacking
Remediation for OkoBot: Multi-Stage Malware Framework Targeting
Immediate actions
- Block all listed C2 domains and IPs at DNS/perimeter firewall level
- Hunt for the scheduled task named 'Apple Sync' and remove it if found
- Search endpoints for %PROGRAMDATA%\HDVideo\HDUtil.exe, %PROGRAMDATA%\hwid.dat, %PROGRAMDATA%\oko_ver, %TEMP%\extl.exe, %USERPROFILE%\.ssh\go.bat
- Isolate and re-image any host with an unauthorized account in the Remote Desktop Users group or a patched termsrv.dll
- Rotate/move cryptocurrency wallet seed phrases and re-key any Trezor/Ledger/Exodus wallet accessed on a suspected-infected host
- Force credential rotation for browser-saved passwords, KeePassXC, and 1Password vaults on affected hosts
Workarounds
- Block execution of msconfig.exe UAC auto-elevation abuse via applied AppLocker/WDAC rule where RDP/UAC bypass is not required
- Monitor and alert on DLL loads of protobuf.dll/version.dll from non-standard Volume2 install paths
Longer-term hardening
- Deploy EDR with behavioral detection for VMProtect-packed binaries and DLL search-order hijacking of legitimate utilities (e.g. Volume2)
- Enforce application allowlisting to prevent execution of unsigned/GitHub-sourced 'legitimate' software impersonating known tools (SSMS, Audacity)
- Restrict outbound SSH and SFTP from standard user workstations
- Deploy browser-extension allowlisting/management policies to block unsanctioned Chromium extensions
- User awareness training on ClickFix-style social engineering (fake CAPTCHA/verification prompts instructing users to run PowerShell)
Weaknesses (CWE) in OkoBot: Multi-Stage Malware Framework Targeting
CWE-506, CWE-427, CWE-269, CWE-311
Timeline of OkoBot: Multi-Stage Malware Framework Targeting
- First TookPS PowerShell downloader campaign discovered by Kaspersky, distributed via trojanized software impersonating UltraViewer, AutoCAD, SketchUp, and Ableton.
- Malicious GitHub repository hosting the trojanized Audacity/SSMS-impersonating installer is created at the end of March 2025; it remains live and reachable until June 2026.
- TookPS begins delivering the TeviRAT remote access trojan as a follow-on payload.
- OkoBot framework redesign implemented: TookPS chain extended to deliver VMProtect-packed HDUtil launcher via SFTP, introducing UAC bypass and RDP-enablement capabilities.
- Campaign enters its most active phase, ultimately infecting hundreds of victims across 25+ countries through June 2026.
- Kaspersky identifies multiple attacks involving a then-unidentified malware wave in January 2026, later reconstructed as the transitional phase of the OkoBot infection chain leading into the March 2026 redesign.
- Operators streamline the infection chain: TeviRAT and HDUtil are dropped, and Volume2 (DLL-hijacked with malicious protobuf.dll/version.dll) is deployed directly as the plugin dispatcher.
- The trojanized-Audacity GitHub distribution repository, live since late March 2025, is taken down/expires by June 2026.
- Kaspersky telemetry shows the campaign remains active through the end of June 2026, with heaviest concentrations of victims in Brazil, Vietnam, Canada, Mexico, and Turkiye.
- Kaspersky Securelist publishes full technical analysis of the OkoBot framework, including infrastructure, TTPs, and IOCs.
Sources cited for OkoBot: Multi-Stage Malware Framework Targeting
- OkoBot: a framework targeting cryptocurrency wallets
- TookPS distributed under the guise of UltraViewer, AutoCAD, and Ableton
- Stealers and backdoors are spreading under the guise of a DeepSeek client
- Securelist | Kaspersky's threat research and reports
- Software Discovery: Security Software Discovery, Sub-technique T1518.001
Threats related to OkoBot: Multi-Stage Malware Framework Targeting
- OkoBot Malware Framework Injects Seed-Phrase Phishing Pages Into Ledger and Trezor Wallet Apps
- BoryptGrab GitHub Supply Chain Malware Campaign — 100+ Malicious Repositories Distributing Multi-Stage Stealer
- UAT-11795 Deploys Novel Starland RAT and Bespoke WLDR C2 Implant in Financially Motivated Campaign
Detection coverage for TL-2026-1363
As of 2026-07-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1363 across Splunk SPL, Microsoft KQL and Sigma, covering 45 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.