OkoBot Malware Framework Injects Seed Phrase Phishing Into Ledger and Trezor Apps
OkoBot malware framework targets Ledger and Trezor users by injecting fake recovery phrase prompts.
The OkoBot malware framework, active since April 2025, has a module called SeedHunter designed to steal hardware wallet recovery phrases from Ledger and Trezor users. It injects fake prompts into the legitimate desktop applications, tricking victims into revealing their seed phrases. The malware uses various infection vectors, including trojanized software on GitHub, and exfiltrates stolen data through SSH tunnels.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Ledger Live?
Get an email when a new story names Ledger Live, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe OkoBot malware framework exploits user trust in legitimate hardware wallet applications by injecting convincing fake prompts that trick victims into voluntarily entering their seed phrases — the master keys to their cryptocurrency holdings. The primary infection vector involves trojanized software distributed via GitHub, highlighting how supply chain and software sourcing risks extend even to open-source platforms. Once a seed phrase is compromised, all associated crypto assets can be irreversibly stolen, with no recourse or recovery mechanism available. This attack succeeds largely because users lack awareness that legitimate hardware wallet applications will never prompt for a seed phrase on a desktop screen. The combination of social engineering, process injection, and covert exfiltration via SSH tunnels makes this a sophisticated, multi-layered threat.
What helps against this
How we list vendors- Device management (MDM and UEM)
Every company laptop and phone is known, encrypted, locked down and up to date.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- domain — moonsand[.]store
- malware — OkoBot
- malware — SeedHunter
- malware — TookPS
- malware — HDUtil
- malware — Volume2