Kaspersky researchers have uncovered OkoBot, a sophisticated malware framework that injects phishing pages directly into Ledger Live and Trezor Suite, tricking users into handing over their recovery phrases while their hardware wallets remain secure.
Your hardware wallet is secure. But the software on your computer? That’s a different story.
Since April 2025, a modular malware framework called OkoBot has been silently hunting Windows users across the globe, specifically targeting cryptocurrency holders with sophisticated techniques. Kaspersky’s GReAT team dropped a bombshell technical analysis on July 15, 2026, revealing hundreds of victims spread across more than 25 countries. Brazil, Vietnam, Canada, Mexico, and Türkiye have been hit hardest. The framework carries over 20 payloads and implants, and it remained active as of the report date, showing no signs of slowing down.
How the SeedHunter Module Works
Here’s the terrifying part. OkoBot deploys a specialized module named SeedHunter that targets your hardware wallet desktop applications—specifically Trezor Suite, Ledger Wallet, and Ledger Live. It doesn’t just show a fake window beside the real one. It injects directly into the Electron internals of the legitimate applications. The phishing page appears inside the real software interface. You think you’re using authentic software because you are. But something sinister is living inside it, watching your every move.
SeedHunter communicates with a command-and-control server at moonsand[.]store. When the C2 sets a Wait flag, the malware scans for USB vendor and product IDs, intelligently delaying the phishing prompt until you physically plug in your actual Ledger or Trezor device. This makes the attack feel legitimate and timed perfectly with your actions. When the flag is off, the fake recovery page appears immediately upon opening the app. The hardware wallet itself remains secure—it never exposes your seed phrase. But your companion desktop software gets tricked into asking for it, creating a dangerous false sense of security.
Once you type those recovery words, a hooked console message handler marked mal_LogConsoleMessage captures everything. Your seed phrase gets exfiltrated as JSON to the attackers, with an RC4-encrypted copy stored in a temporary file on your machine for backup.
How They Get In
Two infection vectors have been identified by security researchers. First, ClickFix social-engineering lures trick users into compromising their own systems through convincing technical support scams that appear to fix non-existent problems. Second, attackers maintain trojanized software repositories on GitHub that exploit trust in open-source platforms. One repository advertised SQL Server Management Studio but actually distributed Audacity rebuilt with a malicious implant. It ranked highly for SSMS search terms and remained active from late March 2025 through June 2026, catching developers and IT professionals who thought they were downloading legitimate database management tools.
Both entry paths deploy TookPS, a PowerShell downloader that installs an SSH service and creates a reverse tunnel to an attacker-controlled server. Then it waits patiently for further instructions. Once the automated SSH bot connects, it inventories your system, disables Windows Defender notifications, and exfiltrates wallet files, browser cookies, browser profiles, and stored credentials.
The attacker then opens your firewall for inbound RDP, adds a user to the Remote Desktop Users group, and replaces termsrv.dll with a patched version permitting concurrent sessions for multiple simultaneous connections. To maintain persistence and ensure they never lose access, they schedule a recurring Apple Sync task that rebuilds the reverse SSH tunnel every hour, keeping the backdoor open indefinitely.
Additional Weapons in the Arsenal
A VMProtect-packed launcher called HDUtil executes additional modules and can silently elevate privileges through a Windows RPC UAC bypass originally documented by Google’s Project Zero in 2019. This allows the malware to gain administrative access without triggering security warnings.
This isn’t the first time hardware wallets have faced such sophisticated threats. In March, GlassWorm targeted Windows machines using WMI to detect USB insertion, killing the real wallet app before showing a fake window. More recently, AMOS struck macOS users by replacing Ledger Live with a trojanized clone in the /Applications folder, proving that no operating system is completely safe.
Your hardware wallet still protects your private keys in its secure chip. But if malware compromises the computer you’re plugging it into, that protection won’t stop a sophisticated phishing interface from asking you to surrender your seed phrase. Keep your software updated. Verify every download through official channels only. And never enter your recovery phrase into any interface that appears unexpectedly, no matter how legitimate it looks.