New OkoBot framework deploys 20 payloads to steal data, crypto
OkoBot malware framework deploys 20 payloads to steal crypto wallets, credentials, and sensitive data.
A new malicious framework called OkoBot delivers over 20 payloads in campaigns targeting cryptocurrency wallet seed phrases, credentials, and sensitive data. The malware reaches victims through ClickFix attacks and trojanized GitHub repositories, evolving from the TookPS campaign that began in March 2025. Victims are primarily in Brazil, Vietnam, Canada, Mexico, and Turkey, with indicators suggesting Russian-speaking threat actors.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Kaspersky?
Get an email when a new story names Kaspersky, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe OkoBot framework succeeds primarily because it exploits human behavior — tricking users into executing malicious code through deceptive ClickFix prompts and tampered GitHub repositories that appear legitimate. This multi-payload attack chain targets high-value assets including cryptocurrency wallet seed phrases and stored credentials, making the financial and personal impact severe. The use of trojanized open-source repositories highlights a growing supply chain risk where developers and end users alike may unknowingly download weaponized tools. The campaign's evolution from TookPS demonstrates that threat actors are rapidly iterating their delivery mechanisms, making static defenses insufficient. Organizations and individuals must treat unsolicited execution prompts and unverified code repositories as high-risk vectors.
What helps against this
How we list vendors- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Data loss prevention (DLP)
Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — OkoBot
- malware — TookPS
- malware — Rilide
- malware — SeedHunter
- malware — MC Keylogger
- malware — OkoSpyware
- malware — extl.exe