OkoBot Malware Targets Ledger and Trezor Wallet Users
New ransomware specifically attacks cryptocurrency wallet recovery phrases.
1OkoBot Threat
The OkoBot malware has been active on Windows machines since April 2025. It contains a module specifically targeting hardware wallet users. Kaspersky's research identified hundreds of victims across Brazil, Vietnam, Canada, Mexico, and Turkey.
2SeedHunter Module
The SeedHunter module detects and injects into Trezor Suite and Ledger applications. Designed to steal recovery phrases, it displays fake recovery pages when a real wallet is connected and records entered phrases.
3Infection Methods
OkoBot spreads through fake SSMS software or trojanized applications on GitHub. The TookPS PowerShell downloader creates SSH tunnels to infiltrate systems and uses automated bots to steal data.
4Security Vulnerability
The attack targets wallet desktop software rather than the hardware itself. Users should be wary of pages appearing within applications without corresponding device screen instructions.
5Detection Methods
Scheduled tasks named Apple Sync, modified termsrv.dll files, or unexpected SSH connections may indicate OkoBot presence. Kaspersky notes C2 servers return empty responses to Russian and CIS IPs.
6User Warnings
Ledger and Trezor emphasize their software never asks for recovery phrases. Pages appearing without device screen confirmation should be rejected. Users must maintain updated security measures.