# Kaspersky Identifies New Crypto-Targeting Malware Framework

OkoBot malware framework targets cryptocurrency investors.

- **Source:** [Cointelegraph.com News](https://brifing.si/source/2e81e982-0137-4db0-8ac2-351f37085775)
- **Published:** 2026-07-18
- **Topic:** [Finance](https://brifing.si/c/finance)
- **Original article:** <https://cointelegraph.com/news/kaspersky-malware-framework-crypto-investors?utm_source=rss_feed&utm_medium=rss&utm_campaign=rss_partner_inbound>
- **On Brifing:** https://brifing.si/s/79e9c4f4-ecaa-4c50-90e9-c62a1e3de0df

## OkoBot Malware Framework

Kaspersky has discovered a new malware framework targeting cryptocurrency investors. Named OkoBot, this malware initiates an infection chain starting with social engineering tactics. Users are tricked into executing malicious commands through methods like ClickFix.

## Infection Methods

The malware delivers a backdoor to devices through trojanized applications distributed via GitHub. This method allows the theft of crypto wallet files, browser data, and user credentials.

## Malicious Payloads

OkoBot coordinates 20 different malicious payloads via an SSH tunnel. This method enables attackers to transport data from infected computers to remote machines.

## LinkedIn-Based Attack

SlowMist has identified a new malware campaign targeting Web3 developers through LinkedIn. Attackers deceive developers by sending fake GitHub repositories.

## Technical Workflow

The attack mimics a legitimate technical interview workflow. Developers pull code, install dependencies, and launch the project, making it difficult to detect the attack.

## Rising Threats

Recent incidents show that attackers are increasingly using scenarios like recruitment, code reviews, and project collaborations to deceive developers. The rise of such attacks poses a serious threat to the crypto ecosystem.

## Sources covering this story

- https://cointelegraph.com/news/kaspersky-malware-framework-crypto-investors?utm_source=rss_feed&utm_medium=rss&utm_campaign=rss_partner_inbound — 

---

_Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._
