OkoBot Fakes Wallet App Screens to Steal Seed Phrases

How the attack worked

OkoBot is a Windows malware framework that has been active since April 2025. Once it infects a machine, it uses a module called SeedHunter that waits for a real Ledger or Trezor hardware wallet to be plugged in. Only then does it draw a hard-coded recovery phrase page styled to match that specific wallet brand, displayed inside the legitimate desktop app the victim already trusts. Because the surrounding app is genuine, the fake page can blend in convincingly and prompt victims to type their 12 or 24 word recovery phrase directly into attacker-controlled infrastructure.

Kaspersky observed two main ways OkoBot reaches victims: a ClickFix-style lure that convinces someone to run a script, and trojanized software hosted on GitHub. In one documented case, a repository advertised as SQL Server Management Studio actually shipped a modified build of Audacity with a malicious library implanted inside it, and it ranked highly for SSMS searches for several months in 2025. Both infection paths lead to a PowerShell downloader that sets the stage for later modules, including remote access capability such as SSH tunneling and enabling RDP.

Why it succeeded

The core of this attack's effectiveness is that the request for a recovery phrase does not come from a suspicious website or an obvious phishing email. It comes from inside the wallet's own desktop software, an app the user installed intentionally and has learned to trust. Victims have no reason to doubt a screen that appears to be part of the software they already rely on to manage their crypto assets. The GitHub distribution path adds another layer of misdirection: users searching for a legitimate, well-known admin tool land on a repository that appears credible and popular.

What to watch for

• A recovery phrase or seed phrase prompt that appears unexpectedly inside a wallet desktop app
• A prompt that shows up immediately after plugging in a hardware wallet, with no corresponding request on the device's own screen
• Downloads of common tools from third-party GitHub repositories rather than official vendor sites
• Being told to run a script or command to "fix" a security issue outside normal IT channels

How to build resistance

Teams handling corporate or personal crypto wallets should be trained to treat any unexpected recovery phrase request as suspicious, even when it appears inside familiar software. The key rule to reinforce: a hardware wallet's recovery flow should be confirmed on the physical device screen itself, not solely inside the desktop app. Encouraging staff, especially IT, developers, and database administrators, to download tools only from official vendor sources reduces exposure to trojanized packages. Awareness training should also cover ClickFix-style lures that push users toward running scripts, since that pattern was a primary entry point in this campaign.

What is OkoBot malware?

OkoBot is a Windows malware framework active since April 2025 that includes a module called SeedHunter, designed to trick hardware wallet owners into typing their recovery phrase into a fake page shown inside the real Ledger or Trezor desktop app.

How does OkoBot get onto a victim's computer?

Kaspersky identified two main infection paths: a ClickFix-style lure that convinces users to run a script, and trojanized software distributed on GitHub, including a repository that advertised SQL Server Management Studio but actually delivered a modified version of Audacity.

How can I tell if a recovery phrase prompt is fake?

A legitimate hardware wallet recovery flow is driven by the physical device itself. If a recovery phrase request appears inside the desktop app right after plugging in the device, with nothing shown on the device's own screen, that mismatch is a strong sign of a scam.

Who has been affected by OkoBot?

Kaspersky reports hundreds of victims across more than 25 countries, with the largest concentrations in Brazil, Vietnam, Canada, Mexico, and Türkiye.