# OkoBot: Multi-Stage Malware Framework Targeting Cryptocurrency Wallets (TookPS/HDUtil/Volume2/SeedHunter)

> Kaspersky Securelist details OkoBot, a modular Windows infection chain (TookPS downloader, HDUtil launcher, Volume2 plugin dispatcher, SeedHunter, MC Keylogger, OkoSpyware) that harvests browser data, wallet seed phrases, and credentials from Trezor Suite, Ledger Wallet/Live, Exodus, and Litecoin QT. The campaign has run since March 2025, infecting hundreds of victims across 25+ countries.

- **Published:** 2026-07-15T00:00:00Z
- **Last reviewed:** 2026-07-15T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1363
- **ID:** TL-2026-1363
- **Severity:** CRITICAL
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 45 (full data via the Threadlinqs MCP server — Purple tier)

## Description

OkoBot is a modular cryptocurrency-theft framework tracked by Kaspersky since a March 2025 TookPS downloader campaign. Initial access is achieved via ClickFix social-engineering lures and trojanized software distributed through GitHub, most notably a legitimate copy of Audacity recompiled with a malicious implant and repackaged to impersonate SQL Server Management Studio (SSMS) so it surfaces in search-engine results. TookPS is a malicious PowerShell downloader (detected by Kaspersky as Trojan-Downloader.Win32.TookPS) that establishes outbound SSH connections, forwards SSH daemon ports, and schedules tasks (including a persistence task named 'Apple Sync' that re-establishes a reverse SSH tunnel hourly) to pull down further payloads and exfiltrate data over SFTP.

In the April 2025 redesign, TookPS delivers HDUtil, a VMProtect-packed auxiliary launcher retrieved over SFTP. HDUtil enumerates the host (active sessions, graphics adapters) and executes further modules via a 'target' command. It performs privilege escalation using a 2019 Project Zero-documented UAC bypass abusing Windows RPC and the auto-elevated msconfig.exe binary, and can enable RDP access by modifying the firewall, adding accounts to the Remote Desktop Users group, and patching termsrv.dll to allow concurrent RDP sessions. Each infected host is fingerprinted using an MD5 HWID hash cached at %PROGRAMDATA%\hwid.dat, which also doubles as the RC4 key used to encrypt exfiltrated wallet seed-phrase backups.

By March 2026 the actor streamlined the chain: TookPS and HDUtil were dropped in favor of deploying Volume2 directly. Volume2 is a legitimate open-source volume-control utility whose DLL search order is hijacked with a malicious protobuf.dll (later renamed version.dll) that acts as the framework's plugin dispatcher. It decrypts and loads implants using AES-GCM, then communicates outbound over HTTP with AES-CBC-encrypted JSON, polling its C2 roughly every 20 seconds for tasking.

Volume2 injects several second-stage implants into legitimate processes: ext_daemon, a browser-extension loader functionally identical to extl.exe that installs a malicious extension (associated with the Rilide family, advertised on Russian-language cybercrime forums) into Chromium-based browsers (Chrome, Edge, Brave) to steal session data and credentials; SeedHunter, which specifically targets Trezor Suite and Ledger Wallet/Live desktop applications plus Exodus and Litecoin QT to locate and exfiltrate wallet seed phrases and keystore material; MC Keylogger, which captures keystrokes, clipboard contents, connected USB device metadata, and periodic screenshots; and OkoSpyware, which uses a bundled FFmpeg binary to record screen video and keystrokes specifically while cryptocurrency wallet applications or KeePassXC/1Password password-manager windows are in focus. Exfiltrated artifacts (keylogs, screenshots, video recordings) are uploaded via HTTP POST to an ir-post.php endpoint on operator infrastructure.

Infrastructure is geoblocked so victim traffic originating from Russia and CIS countries is rejected, and SeedHunter's source contains Russian-language developer comments, together suggesting a Russian-speaking threat actor; Kaspersky stops short of formal attribution to a named group. Victims cluster heavily in Brazil, Vietnam, Canada, Mexico, and Turkiye, with hundreds of confirmed infections across more than 25 countries during the January-June 2026 active phase.

## MITRE ATT&CK

- T1566 Phishing
- T1189 Drive-by Compromise
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1053.005 Scheduled Task
- T1053.005 Scheduled Task
- T1136.001 Local Account
- T1133 External Remote Services
- T1176 Software Extensions
- T1548.002 Bypass User Account Control
- T1055 Process Injection
- T1027.002 Software Packing
- T1574.001 DLL
- T1036.005 Match Legitimate Resource Name or Location
- T1686 Disable or Modify System Firewall
- T1601.001 Patch System Image
- T1140 Deobfuscate/Decode Files or Information
- T1056.001 Keylogging
- T1555.005 Password Managers
- T1555.003 Credentials from Web Browsers
- T1082 System Information Discovery
- T1016 System Network Configuration Discovery
- T1120 Peripheral Device Discovery
- T1113 Screen Capture
- T1125 Video Capture
- T1115 Clipboard Data
- T1074 Data Staged
- T1071.001 Web Protocols
- T1573.001 Symmetric Cryptography
- T1572 Protocol Tunneling
- T1219 Remote Access Tools
- T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol
- T1041 Exfiltration Over C2 Channel
- T1657 Financial Theft

## Sources

- [OkoBot: a framework targeting cryptocurrency wallets](https://securelist.com/okobot-framework-targets-cryptocurrency-wallets/120660/)
- [TookPS distributed under the guise of UltraViewer, AutoCAD, and Ableton](https://securelist.com/tookps/116019/)
- [Stealers and backdoors are spreading under the guise of a DeepSeek client](https://securelist.com/backdoors-and-stealers-prey-on-deepseek-and-grok/115801/)
- [Securelist | Kaspersky's threat research and reports](https://securelist.com/)
- [Software Discovery: Security Software Discovery, Sub-technique T1518.001](https://attack.mitre.org/techniques/T1518/001/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1363