Kasperskyが暗号資産ユーザーを狙う新型フレームワーク「OkoBot」を発見。SeedHunterがLedger LiveやTrezor Suiteなど正規アプリの内側から偽のシードフレーズ復元画面を表示して窃取する。ClickFixやGitHubの偽SSMSが侵入口で、被害は25か国以上・数百人。

A newly documented malware framework dubbed OkoBot is targeting cryptocurrency users with a multi-stage intrusion chain designed to capture Ledger and Trezor recovery phrases.

CryptoMarket and Blockchain News

The OkoBot framework, particularly its SeedHunter module, targets popular hardware wallets like Ledger and Trezor.

OkoBot is a malicious framework that uses ClickFix attacks and fake GitHub software repositories to deliver more than 20 payloads aimed at stealing cryptocurrency wallet seed phrases, credentials, and other sensitive data. Kaspersky says the campaign evolved from TookPS, uses multiple stages including an SSH bot, and has heavily targeted users in Brazil while remaining active globally. #OkoBot #TookPS #Kaspersky #SeedHunter #Rilide

A newly documented malware framework dubbed OkoBot is targeting cryptocurrency users with a multi-stage intrusion chain designed to capture Ledger and Trezor recovery phrases.

OkoBot is a Windows malware framework active since April 2025 that uses its SeedHunter module to steal hardware wallet recovery phrases by injecting fake recovery pages into legitimate Ledger Live, Ledger Wallet, and Trezor Suite software. Kaspersky found hundreds of victims across more than 25 countries, with notable concentration in Brazil,...

Kaspersky identified the active OkoBot campaign, a multi-stage framework that uses TookPS, SSH tunneling, browser extension theft, keylogging, and spyware to steal cryptocurrency wallets and other credentials. The operation has evolved since 2025, now distributing over 20 payloads and targeting victims in more than 25 countries while remaining active. #TookPS #OkoBot #TeviRAT #Rilide #Volume2 #SeedHunter #OkoSpyware

OkoBotと名付けられた新たに確認されたマルウェアフレームワークが、暗号資産ユーザーを標的にした多段階の侵入チェーンを展開しています。Ledgerおよび Trezorのリカバリーフレーズ、ブラウザの認証情報、ウォレットファイル、キーストローク、スクリーンショット、アプリケーションの映像記録などを窃取することを目的と