Kaspersky Identifies New Crypto-Targeting Malware Framework
OkoBot malware framework targets cryptocurrency investors.
1OkoBot Malware Framework
Kaspersky has discovered a new malware framework targeting cryptocurrency investors. Named OkoBot, this malware initiates an infection chain starting with social engineering tactics. Users are tricked into executing malicious commands through methods like ClickFix.
2Infection Methods
The malware delivers a backdoor to devices through trojanized applications distributed via GitHub. This method allows the theft of crypto wallet files, browser data, and user credentials.
3Malicious Payloads
OkoBot coordinates 20 different malicious payloads via an SSH tunnel. This method enables attackers to transport data from infected computers to remote machines.
4LinkedIn-Based Attack
SlowMist has identified a new malware campaign targeting Web3 developers through LinkedIn. Attackers deceive developers by sending fake GitHub repositories.
5Technical Workflow
The attack mimics a legitimate technical interview workflow. Developers pull code, install dependencies, and launch the project, making it difficult to detect the attack.
6Rising Threats
Recent incidents show that attackers are increasingly using scenarios like recruitment, code reviews, and project collaborations to deceive developers. The rise of such attacks poses a serious threat to the crypto ecosystem.