[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fHCufNpa3wore8oEd0oN6qWxZkyOjkJU5SSlTN6UuIu8":3},{"article":4,"iocs":50,"watch_terms":72,"solutions":73,"lesson":159},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"0f32a60a-c585-4a6a-9d3f-ed3409a1d229","New OkoBot framework deploys 20 payloads to steal data, crypto","new-okobot-framework-deploys-20-payloads-to-steal-data-crypto-3600e5","A new malicious framework called OkoBot is delivering more than 20 payloads in attacks focused on stealing cryptocurrency wallet seed phrases, credentials, and other sensitive data. [...]","A new malicious framework called OkoBot delivers over 20 payloads in campaigns targeting cryptocurrency wallet seed phrases, credentials, and sensitive data. The malware reaches victims through ClickFix attacks and trojanized GitHub repositories, evolving from the TookPS campaign that began in March 2025. Victims are primarily in Brazil, Vietnam, Canada, Mexico, and Turkey, with indicators suggesting Russian-speaking threat actors.","OkoBot malware framework deploys 20 payloads to steal crypto wallets, credentials, and sensitive data.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fnew-okobot-framework-deploys-20-payloads-to-steal-data-crypto\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F07\u002F16\u002Fokobot.jpg","2026-07-16T19:09:35+00:00","2026-07-16T20:00:25.351961+00:00",9,[17,20,23,25],{"name":18,"type":19},"Kaspersky","vendor",{"name":21,"type":22},"Trezor Suite","product",{"name":24,"type":22},"Ledger Wallet",{"name":26,"type":22},"Ledger Live","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":27,"icon":29,"name":30,"slug":31},null,"Malware","malware",[33,38,43,45],{"category":34},{"id":35,"icon":29,"name":36,"slug":37},"0493c7e9-989a-4692-b4e6-136f5ec09675","Cryptography","cryptography",{"category":39},{"id":40,"icon":29,"name":41,"slug":42},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":44},{"id":27,"icon":29,"name":30,"slug":31},{"category":46},{"id":47,"icon":29,"name":48,"slug":49},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[51,54,57,60,63,66,69],{"type":31,"value":52,"context":53},"OkoBot","Main malicious framework deploying 20+ payloads for data and crypto theft",{"type":31,"value":55,"context":56},"TookPS","Malicious PowerShell script used in first phase of OkoBot infection chain",{"type":31,"value":58,"context":59},"Rilide","Malicious browser extension targeting credentials, cookies, and crypto data",{"type":31,"value":61,"context":62},"SeedHunter","Module injecting into Trezor Suite and Ledger wallets to steal seed recovery phrases",{"type":31,"value":64,"context":65},"MC Keylogger","Module recording keystrokes, clipboard activity, USB connections, and screenshots",{"type":31,"value":67,"context":68},"OkoSpyware","Module monitoring 100 programs including crypto wallets and password managers with video recording",{"type":31,"value":70,"context":71},"extl.exe","Daemon module injecting into Chrome browsers to install malicious extensions",[18,21,24],{"controls":74,"vendors":158},[75,104,133],{"slug":76,"name":77,"problem":78,"products":79},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[80,88,96],{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"slug":105,"name":106,"problem":107,"products":108},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[109,117,125],{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-dlp","Netskope DLP","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention for web, cloud apps, AI tools and endpoints.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",{"slug":134,"name":135,"problem":136,"products":137},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[138,144,151],{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":139,"product_name":140,"url":142,"description":143},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":145,"vendor_name":146,"vendor_logo":147,"product_slug":134,"product_name":148,"url":149,"description":150},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":152,"vendor_name":153,"vendor_logo":154,"product_slug":152,"product_name":155,"url":156,"description":157},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",[],{"slug":160,"title":161,"body":162,"framework_refs":163,"framework_notes":175},"okobot-malware-framework-exploits-user-trust-via-clickfix-and-trojanized-github-repos","OkoBot Malware Framework Exploits User Trust via ClickFix and Trojanized GitHub Repos","The OkoBot framework succeeds primarily because it exploits human behavior — tricking users into executing malicious code through deceptive ClickFix prompts and tampered GitHub repositories that appear legitimate. This multi-payload attack chain targets high-value assets including cryptocurrency wallet seed phrases and stored credentials, making the financial and personal impact severe. The use of trojanized open-source repositories highlights a growing supply chain risk where developers and end users alike may unknowingly download weaponized tools. The campaign's evolution from TookPS demonstrates that threat actors are rapidly iterating their delivery mechanisms, making static defenses insufficient. Organizations and individuals must treat unsolicited execution prompts and unverified code repositories as high-risk vectors.",[164,165,166,167,168,169,170,171,172,173,174],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 3: Data Protection","CIS Control 14: Security Awareness and Skills Training","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 SA-12: Supply Chain Protection","NIST SP 800-53 AC-3: Access Enforcement","NIST CSF DE.CM-4: Malicious Code Detection","GDPR Article 32: Security of Processing","MITRE ATT&CK T1059: Command and Scripting Interpreter","MITRE ATT&CK T1195: Supply Chain Compromise","MITRE ATT&CK T1555: Credentials from Password Stores",{}]