New OkoBot framework deploys 20 payloads to steal data, crypto

1. Executive summary

Kaspersky GReAT has published details of "OkoBot," a sophisticated Windows malware framework active since at least March 2025 that deploys more than 20 payloads to steal cryptocurrency wallet seed phrases, credentials, and sensitive data. The framework uses two initial access vectors — ClickFix attacks and trojanized GitHub repositories masquerading as legitimate software (e.g., a fake SQL Server Management Studio package that was actually a compiled Audacity binary with a malicious embedded library) — to deliver the TookPS PowerShell downloader, which installs an SSH tunnel for automated payload delivery. Key modules include SeedHunter (injects into Trezor Suite, Ledger Wallet, and Ledger Live to display fake seed-recovery screens), a Rilide-based Chrome extension injector for credential/cookie theft, and screen-capture keyloggers targeting cryptocurrency wallets and password managers. Attribution is unconfirmed; Kaspersky notes Russian-language code comments and CIS-geoblocked infrastructure but does not name a threat actor. EMEA financial services clients with retail cryptocurrency exposure or staff using hardware wallet desktop software on corporate endpoints should treat this as a high-risk data-theft threat.

2. Regulatory framing

3. Technical analysis & attack chain

Confirmed attack chain (corroborated by Kaspersky, BleepingComputer, and The Hacker News)

1. Initial access via ClickFix or malicious GitHub repository. Two vectors are confirmed. In the ClickFix vector, victims are tricked into executing malicious PowerShell. In the GitHub vector, a repository claiming to offer SQL Server Management Studio (SSMS) hosted a trojanized binary — the legitimate Audacity audio editor compiled with a malicious implant embedded in one of its libraries. The repository was created end of March 2025 and remained active until June 2025; it contained a single README.md with a fake SSMS installation guide derived from Microsoft documentation, with a download link pointing to the latest release in the same repository. The repository ranked highly in search engine results for the query "SSMS."
2. TookPS downloader execution. Both vectors trigger execution of the malicious PowerShell script "TookPS," first observed in March 2025. TookPS is a downloader that retrieves malicious commands and scripts from attacker-controlled servers. In the OkoBot campaign, TookPS is used solely for the initial infection phase.
3. SSH installation and tunnel establishment. TookPS installs SSH on the victim's system, establishes a connection to an attacker-controlled SSH server, and forwards the SSH daemon port. Following a delay, an automated SSH bot connects to the forwarded port.
4. Automated SSH bot — system reconnaissance. The SSH bot collects system information including username, antivirus software, IP address, and OS version. It disables Windows Defender notifications.
5. Payload delivery via SSH tunnel. The automated SSH bot is responsible for delivering the remaining 20+ malicious modules through the established tunnel. In the earlier chain (through ~early 2026), the delivery path was: HDUtil launcher → extl injector → Rilide Chrome extension. TeviRAT backdoor was also delivered, which in turn fetched another version of a TookPS script.
6. Data harvesting and exfiltration. The SSH bot harvests cryptocurrency wallet files, browser cookies, and account credentials. Specialised modules (below) perform targeted theft.
7. Evolution — March 2026 variant. Kaspersky discovered a new phase in which Volume2 is installed directly using TookPS. The HDUtil → extl → Rilide chain was abandoned and replaced by the ext_daemon Volume2 plugin. TeviRAT was removed, likely because its functions were absorbed by the new plugin dispatcher.

Key malicious modules (from Kaspersky via BleepingComputer)

• ext daemon / extl.exe: Injects into Chrome browsers to silently install and hide malicious extensions including Rilide, which targets credentials, cookies, financial information, and cryptocurrency-related data.
• SeedHunter: Injects into Trezor Suite, Ledger Wallet, and Ledger Live desktop applications to display a fake seed-recovery screen. The malicious prompt appears from within the legitimate wallet application itself, sometimes waiting until a hardware wallet device is plugged in. The goal is to steal the wallet recovery phrase, which provides full access to the user's cryptocurrency assets with virtually no possibility of recovery.
• MC Keylogger: Records keystrokes and clipboard activity including copied text, images, and file paths. Monitors for USB connections and takes screenshots every 5 minutes.
• OkoSpyware: Monitors approximately 100 programs including cryptocurrency wallets and password managers. Uses FFmpeg to record video of their windows and captures keystrokes.

Kaspersky detection names: Trojan-Downloader.Win32.TookPS., Trojan.Win64.BypassUAC., Trojan-Banker.Script.Agent.gen, Trojan.Win32.Dllhijack., Backdoor.Win32.TeviRat., Trojan-PSW.Win64.Stealer., Trojan-Spy.Win64.Keylogger., Trojan-Spy.Win64.Agent., Trojan.Win64.Agent.

Victimology: Kaspersky telemetry shows the majority of victims in Brazil, followed by Vietnam, Canada, Mexico, and Turkey. The campaign's reach is described as global.

Attribution caveat: Kaspersky does not attribute OkoBot to any named threat actor. No MITRE ATT&CK actor profile is available. Indicators pointing toward a Russian-speaking actor — Russian-language comments in SeedHunter source code, CIS-geoblocked infrastructure (payloads not delivered to Russian/CIS IP addresses; server returns empty response), and an infostealer promoted on invitation-only Russian cybercrime forums — are noted by Kaspersky but remain unconfirmed attribution. This assessment is single-sourced (Kaspersky GReAT only); verify before enforcement.

4. Mitigation & containment

P1 — Within 24 hours

• Block known delivery vectors: Block access to the malicious GitHub repository pattern (fake SSMS / trojanized Audacity). Implement allow-listing for developer tool downloads; enforce that SSMS and other enterprise tools are downloaded only from official Microsoft/vendor portals.
• EDR / AV signature deployment: Ensure Kaspersky detection signatures for TookPS, TeviRAT, BypassUAC, Dllhijack, and the listed Trojan families are deployed. If using non-Kaspersky EDR, create custom detections based on the behavioural indicators in §5.
• SSH on endpoints: Alert on or block outbound SSH connections from non-server workstations, particularly newly installed SSH clients initiating connections to non-corporate infrastructure. OkoBot installs SSH on the victim and forwards the daemon port — this is anomalous on typical corporate endpoints.
• Browser extension lockdown: Enforce Chrome extension allow-listing via Group Policy/MDM to prevent silent installation of Rilide and similar malicious extensions.
• Windows Defender tamper protection: Enable tamper protection to prevent disabling of Defender notifications. Alert on any attempt to modify Defender notification state.

P2 — Within 72 hours

• Hunt for OkoBot modules on endpoints: Search for the named binaries and components — extl.exe, ext_daemon, Volume2 plugin artefacts, and any FFmpeg binaries in unexpected locations (OkoSpyware uses FFmpeg for window recording). Search for processes injecting into Trezor Suite, Ledger Wallet, and Ledger Live.
• Cryptocurrency wallet application hardening: If hardware wallet desktop software (Trezor Suite, Ledger Live) is permitted on corporate endpoints, ensure it is installed only from official sources. Alert on any unauthorised DLL injection or UI modification within these applications. Educate users that legitimate hardware wallet software will never prompt for a full seed phrase entry on the computer — this is always done on the device itself.
• Clipboard monitoring controls: Deploy EDR rules to detect clipboard content capture (MC Keylogger targets copied text, images, file paths). Alert on processes accessing clipboard APIs that are not in the approved application list.
• USB device monitoring: MC Keylogger monitors for USB connections. Alert on processes that enumerate USB devices outside of expected system services.

P3 — Within 7 days

• ClickFix awareness training: Update phishing awareness content to include ClickFix-style attacks (fake verification/CAPTCHA prompts that trick users into running PowerShell commands).
• GitHub repository monitoring: Implement controls to detect users downloading software from unverified GitHub repositories. Consider blocking GitHub Releases downloads for non-approved repositories on managed endpoints.
• Threat hunt for historical compromise: Search endpoint logs back to March 2025 for indicators of TookPS execution, SSH client installation on workstations, and outbound SSH connections to non-corporate destinations. The campaign has been active for over a year.
• Review endpoint allow-listing posture: The trojanized Audacity binary demonstrates that compiled legitimate software with embedded malicious libraries can bypass application reputation controls. Evaluate binary integrity verification (code signing validation) for high-risk applications.

5. Indicators of compromise

Kaspersky's report references a set of IOCs including hashes for malicious plugins, injector payloads, SSH bot utilities, file paths, domains, and IP addresses. However, the specific IOC values were not included in the source material provided to Adverse Trace. No atomic indicators of compromise are available in the provided source material. Clients should retrieve the full IOC set directly from the Kaspersky Securelist report at https://securelist.com/okobot-framework-targets-cryptocurrency-wallets/120660/.

Behavioural indicators

6. Detection

rule OkoBot_TookPS_Downloader {
  meta:
    author = "Adverse Trace"
    date = "2026-07-16"
    reference = "https://securelist.com/okobot-framework-targets-cryptocurrency-wallets/120660/"
    description = "Detects TookPS PowerShell downloader and OkoBot framework components"
  strings:
    $tookps1 = "TookPS" wide ascii
    $extl = "extl.exe" wide ascii
    $ext_daemon = "ext_daemon" wide ascii
    $seedhunter = "SeedHunter" wide ascii
    $okospyware = "OkoSpyware" wide ascii
    $mckeylogger = "MC Keylogger" wide ascii
    $rilide = "Rilide" wide ascii
    $tevirat = "TeviRAT" wide ascii
    $hdutil = "HDUtil" wide ascii
    $volume2 = "Volume2" wide ascii
  condition:
    3 of them
}

title: OkoBot SSH Tunnel Installation via PowerShell on Workstation
id: 7a3c1f2e-2026-0716-0001
status: experimental
description: Detects TookPS-style installation of SSH client and outbound SSH connection from a workstation, consistent with OkoBot framework initial staging
author: Adverse Trace
date: 2026/07/16
references:

  - https://securelist.com/okobot-framework-targets-cryptocurrency-wallets/120660/
logsource:
  product: windows
  category: process_creation
detection:
  selection_ssh_install:
    Image|endswith:

      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:

      - 'ssh'
      - 'sshd'
  selection_ssh_connect:
    Image|endswith:

      - '\ssh.exe'
      - '\sshd.exe'
    CommandLine|contains:

      - '-R'
      - '-L'
      - 'tunnel'
  filter_legitimate:
    CommandLine|contains:

      - 'git@github.com'
      - 'git@gitlab'
  condition: selection_ssh_install or (selection_ssh_connect and not filter_legitimate)
falsepositives:

  - Legitimate SSH usage by developers or IT administrators
  - Git operations over SSH
level: high

title: OkoBot SeedHunter Injection into Cryptocurrency Wallet Applications
id: 7a3c1f2e-2026-0716-0002
status: experimental
description: Detects process injection into Trezor Suite, Ledger Wallet, or Ledger Live, consistent with OkoBot SeedHunter module
author: Adverse Trace
date: 2026/07/16
references:

  - https://securelist.com/okobot-framework-targets-cryptocurrency-wallets/120660/
logsource:
  product: windows
  category: process_access
detection:
  selection_target:
    TargetImage|endswith:

      - '\trezor-suite.exe'
      - '\Trezor Suite.exe'
      - '\Ledger Live.exe'
      - '\ledger-wallet.exe'
  filter_parent:
    SourceImage|startswith:

      - 'C:\Windows\System32\'
      - 'C:\Program Files\'
  condition: selection_target and not filter_parent
falsepositives:

  - Legitimate software updates or accessibility tools
level: critical

title: OkoBot Windows Defender Notification Disabling
id: 7a3c1f2e-2026-0716-0003
status: experimental
description: Detects attempts to disable Windows Defender notifications, consistent with OkoBot SSH bot behaviour
author: Adverse Trace
date: 2026/07/16
references:

  - https://securelist.com/okobot-framework-targets-cryptocurrency-wallets/120660/
logsource:
  product: windows
  category: process_creation
detection:
  selection_powershell:
    Image|endswith:

      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:

      - 'Defender'
      - 'Notifications'
      - 'Set-MpPreference'
      - 'DisableRealtimeMonitoring'
  condition: selection_powershell
falsepositives:

  - Legitimate endpoint hardening scripts
level: high

7. Sources

• Kaspersky GReAT (Securelist) — "OkoBot: new sophisticated malware framework targets cryptocurrency users" — https://securelist.com/okobot-framework-targets-cryptocurrency-wallets/120660/ — July 2026
• BleepingComputer — "New OkoBot framework deploys 20 payloads to steal data, crypto" — https://www.bleepingcomputer.com/news/security/new-okobot-framework-deploys-20-payloads-to-steal-data-crypto/ — 2026-07-16
• The Hacker News — "OkoBot Malware Framework Injects Seed Phrase Phishing Into Ledger and Trezor Apps" — https://thehackernews.com/2026/07/okobot-malware-framework-injects-seed.html — July 2026

8. Adverse Trace position

OkoBot is a technically sophisticated, actively developed framework that poses a direct threat to any organisation where employees manage cryptocurrency assets or use hardware wallet desktop software on Windows endpoints. The seed-phrase theft capability is particularly damaging — compromise of a recovery phrase provides irreversible access to cryptocurrency holdings with no recourse. The use of SSH tunnelling for C2 and payload delivery is notable for its stealth and its ability to blend with legitimate administrative traffic. The ClickFix and trojanized-GitHub delivery vectors are broadly applicable beyond cryptocurrency users and could be repurposed for broader financial-sector targeting. Attribution remains unconfirmed (single-sourced to Kaspersky GReAT; no MITRE actor profile resolved); the Russian-language indicators and CIS geoblocking are consistent with but not conclusive of a Russian-speaking actor. We are treating this as a high-severity data-theft threat for EMEA financial services clients with cryptocurrency or digital-asset exposure. Next steps: Adverse Trace will monitor for IOC publication in the full Kaspersky report, track any named attribution, and assess whether OkoBot modules or infrastructure appear in client telemetry.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.