Fake SSMS on GitHub Spreads Crypto-Stealing OkoBot

How the attack worked

The OkoBot campaign relied on two separate deception paths to get a malicious script running on a victim's machine. The first was a fake package on GitHub posing as SQL Server Management Studio (SSMS), a legitimate database tool many developers and administrators use regularly. The repository consisted of a single README.md file written in an official style, closely resembling Microsoft's own documentation, with an install link that simply pointed back to the repo's own releases page. The second path was a ClickFix-style web prompt that convinced users to run a PowerShell script called TookPS to 'fix' a supposed problem. Both paths triggered execution of TookPS, which then pulled down further malicious commands and scripts from attacker-controlled infrastructure.

Why it succeeded

The fake SSMS repository worked in part because it was indexed by search engines and ranked at the top of results for the query "SSMS." That visibility substituted for legitimacy in the eyes of many users, who trusted the top search result over verifying the source was an official vendor channel. The installation guide's official-sounding language, likely drawn from real Microsoft documentation, reinforced that false sense of trust. On the ClickFix side, the attack exploited the habit of following on-screen troubleshooting instructions without confirming them through an official support channel first.

What to watch for

• Software download links that point to community GitHub repositories rather than an official vendor site or vendor-hosted release channel
• Installation guides written in an "official style" that direct you back to the same repository for the actual download
• Any web page instructing you to open PowerShell or a terminal and run a command to "fix" an issue
• Unexpected browser extensions or SSH-related activity appearing after installing a tool
• Activity focused on capturing cryptocurrency wallet windows or browser data like cookies and saved credentials

How to build resistance

Organizations should reinforce that common developer and database tools, including SSMS, should only be downloaded from official vendor pages, not from third-party GitHub repositories regardless of search ranking. Employees should be trained to treat any page instructing them to run PowerShell or terminal commands as a red flag requiring verification with IT or security before proceeding. Because this campaign specifically targeted cryptocurrency wallets and browser data, teams with crypto exposure should apply extra scrutiny to browser extensions and wallet access, and IT/helpdesk staff should be equipped to recognize and report ClickFix-style prompts quickly.

This pattern reflects the techniques described under MITRE ATT&CK T1566.003 for spearphishing via service, T1204.002 for user execution of malicious files, and T1105 for ingress tool transfer.

What is the OkoBot attack?

OkoBot is a malware campaign identified by Kaspersky that infects victims through a fake SQL Server Management Studio (SSMS) installer on GitHub or a ClickFix-style prompt, then installs browser-stealing tools to capture crypto wallet and browser data.

How does the fake SSMS GitHub repo trick users?

The repo contains a single README.md file written like an official installation guide, mimicking Microsoft documentation style, with a download link pointing back to the repo's own releases, and it ranked highly in search results for 'SSMS'.

What is a ClickFix attack in this context?

It is a web page prompt that convinces a user to run a malicious PowerShell script, called TookPS, under the guise of 'fixing' something, which then downloads further malicious components.

What does OkoBot target once installed?

It sets up an SSH-based back channel and deploys modules, including a browser extension called Rilide, aimed at stealing cryptocurrency wallet data and browser data such as cookies, profiles, and credentials.