# OkoBot Malware Framework Injects Seed-Phrase Phishing Pages Into Ledger and Trezor Wallet Apps

> OkoBot is a modular crimeware framework active since April 2025, comprising 20+ payloads for cryptocurrency theft and surveillance. Its SeedHunter module hooks Ledger Live, Ledger Wallet, and Trezor Suite Electron internals to inject hard-coded seed-phrase phishing pages, while companion modules (OkoSpyware, MC Keylogger, Rilide) exfiltrate credentials, keystrokes, and browser data. Kaspersky GReAT reports hundreds of victims across 25+ countries as of July 2026, with no attribution to a known crimeware actor.

- **Published:** 2026-07-15T00:00:00Z
- **Last reviewed:** 2026-07-15T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1383
- **ID:** TL-2026-1383
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 42 (full data via the Threadlinqs MCP server — Purple tier)

## Description

OkoBot is a modular malware platform first observed via its TookPS PowerShell downloader in March 2025 and formally profiled by Kaspersky's Global Research and Analysis Team (GReAT) in a July 15, 2026 Securelist report. The framework has evolved through two distinct infection-chain generations. In the original chain (January-April 2025), TookPS - delivered via ClickFix social-engineering lures or trojanized GitHub repositories (e.g., a repo advertised as SQL Server Management Studio that actually shipped a backdoored Audacity build) - installed a reverse SSH tunnel maintained by a scheduled task named 'Apple Sync', then deployed the VMProtect-packed HDUtil launcher, which in turn dropped extl.exe to inject malicious unpacked browser extensions, the TeviRAT backdoor, and the Rilide Chromium-stealer extension. In the updated chain (March 2026 onward), TeviRAT was removed and HDUtil was replaced by Volume2, a hijacked open-source plugin dispatcher that polls its C2 every 20 seconds over a custom protobuf.dll/version.dll loader and directly deploys ext_daemon, SeedHunter, MC Keylogger, and OkoSpyware as plugins exporting RegisterPlugin/PluginDispatch.

The centerpiece module, SeedHunter, monitors for USB attachment of genuine Ledger or Trezor hardware wallets by vendor/product ID and, once detected, hooks Electron internals in Ledger Live, Ledger Wallet, or Trezor Suite to render a hard-coded, brand-specific fake recovery-phrase entry screen. Captured seed phrases are exfiltrated to the dedicated C2 domain moonsand[.]store as a JSON payload containing App, Build, DeviceName, DeviceHardwareId, and SeedData fields. Persistence and lateral-access tradecraft include patching termsrv.dll to permit concurrent RDP sessions, adding accounts to the Remote Desktop Users group, opening inbound RDP through the Windows Firewall, and an hourly-rebuilt reverse SSH tunnel. A UAC bypass abuses auto-elevated msconfig.exe via Windows RPC from JavaScript (a technique documented by Google Project Zero in 2019). Anti-analysis measures include VMProtect obfuscation on HDUtil/extl.exe, AES-GCM (256-bit key/96-bit nonce) payload encryption, AES-CBC C2 traffic encryption (with insecure 0xFF-byte default keys/IVs when not reconfigured), RC4 keyed by a per-victim hardware ID (HWID) for exfiltrated data, MurmurHash3-based export-table function resolution for stripped binaries, and geoblocking of Russian/CIS IP ranges on first-stage PowerShell infrastructure. Complementary modules OkoSpyware (video/keystroke capture) and MC Keylogger (keystrokes, clipboard including copied images/files, USB device logs, five-minute screenshots) stage output locally with timestamp/format-coded filenames (bf_, sc_, sh_, oko_, media_) before exfiltrating via an ir-post.php endpoint and clearing PowerShell command history afterward. Beyond hardware wallets, the framework also targets the Exodus and Litecoin-QT desktop wallets, MetaMask and Tonkeeper browser-extension wallets, and the KeePassXC and 1Password password managers, installing malicious browser extensions into a non-standard 'Local Extension Settings' directory with a custom_args manifest field carrying the victim HWID and browser name to evade the standard extensions list. Kaspersky's telemetry shows hundreds of victims concentrated in Brazil, Vietnam, Canada, Mexico, and Turkiye across more than 25 countries, with the earliest TookPS activity in March 2025 and continuous framework evolution through March 2026. Kaspersky explicitly declines attribution to any known crimeware actor, though it notes soft signals - Russian-language comments embedded in the SeedHunter phishing page source and distribution of the Rilide stealer on Russian-speaking cybercrime forums - that it treats as inconclusive given the deliberate CIS-region geoblocking on the operators' own infrastructure.

## MITRE ATT&CK

- T1566 Phishing
- T1195 Supply Chain Compromise
- T1199 Trusted Relationship
- T1059 Command and Scripting Interpreter
- T1204 User Execution
- T1053 Scheduled Task/Job
- T1053 Scheduled Task/Job
- T1176 Software Extensions
- T1136 Create Account
- T1133 External Remote Services
- T1548 Abuse Elevation Control Mechanism
- T1053 Scheduled Task/Job
- T1027 Obfuscated Files or Information
- T1685 Disable or Modify Tools
- T1112 Modify Registry
- T1070 Indicator Removal
- T1140 Deobfuscate/Decode Files or Information
- T1564 Hide Artifacts
- T1056 Input Capture
- T1555 Credentials from Password Stores
- T1539 Steal Web Session Cookie
- T1087 Account Discovery
- T1120 Peripheral Device Discovery
- T1518 Software Discovery
- T1113 Screen Capture
- T1115 Clipboard Data
- T1125 Video Capture
- T1074 Data Staged
- T1071 Application Layer Protocol
- T1573 Encrypted Channel
- T1572 Protocol Tunneling
- T1105 Ingress Tool Transfer
- T1021 Remote Services
- T1041 Exfiltration Over C2 Channel
- T1657 Financial Theft

## Sources

- [OkoBot Malware Framework Injects Seed Phrase Phishing Pages Into Ledger Wallets and Trezor Suite](https://thehackernews.com/2026/07/okobot-malware-framework-injects-seed.html)
- [OkoBot framework targets cryptocurrency wallets](https://securelist.com/okobot-framework-targets-cryptocurrency-wallets/120660/)
- [OkoBot: new sophisticated malware framework targets cryptocurrency users](https://malware.news/t/okobot-new-sophisticated-malware-framework-targets-cryptocurrency-users/123923)
- [Cryptohack Roundup: Malware Targets Wallets via Photos](https://www.bankinfosecurity.com/cryptohack-roundup-malware-targets-wallets-via-photos-a-28833)
- [Issue 1988: Windows RPC servers from JavaScript (UAC bypass technique)](https://bugs.chromium.org/p/project-zero/issues/detail?id=1988)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1383