# OkoBot Malware Targets Ledger and Trezor Wallet Users New ransomware specifically attacks cryptocurrency wallet recovery phrases. - **Source:** [The Hacker News](https://brifing.si/source/f944ec2b-8180-47bc-94de-57085b5a6563) - **Published:** 2026-07-15 - **Topic:** [Finance](https://brifing.si/c/finance) - **Original article:** - **On Brifing:** https://brifing.si/s/640c510d-d8ce-4c8e-aaa2-194a03304742 ## OkoBot Threat The OkoBot malware has been active on Windows machines since April 2025. It contains a module specifically targeting hardware wallet users. Kaspersky's research identified hundreds of victims across Brazil, Vietnam, Canada, Mexico, and Turkey. ## SeedHunter Module The SeedHunter module detects and injects into Trezor Suite and Ledger applications. Designed to steal recovery phrases, it displays fake recovery pages when a real wallet is connected and records entered phrases. ## Infection Methods OkoBot spreads through fake SSMS software or trojanized applications on GitHub. The TookPS PowerShell downloader creates SSH tunnels to infiltrate systems and uses automated bots to steal data. ## Security Vulnerability The attack targets wallet desktop software rather than the hardware itself. Users should be wary of pages appearing within applications without corresponding device screen instructions. ## Detection Methods Scheduled tasks named Apple Sync, modified termsrv.dll files, or unexpected SSH connections may indicate OkoBot presence. Kaspersky notes C2 servers return empty responses to Russian and CIS IPs. ## User Warnings Ledger and Trezor emphasize their software never asks for recovery phrases. Pages appearing without device screen confirmation should be rejected. Users must maintain updated security measures. ## Sources covering this story - https://thehackernews.com/2026/07/okobot-malware-framework-injects-seed.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._