OkoBot Malware Serves Fake Recovery Pages Inside Real Ledger and Trezor Apps

A malware framework called OkoBot has been quietly working through Windows machines since April 2025, and one of its modules is specifically designed to steal cryptocurrency recovery phrases from hardware wallet owners. Hundreds of victims across more than 25 countries have shown up in Kaspersky's telemetry, with the highest concentrations in Brazil, Vietnam, Canada, Mexico, and Türkiye.

Kaspersky's GReAT team published their full breakdown on July 15. The framework carries over 20 payloads and implants, and was still active at the time of publication.

The Module That Hunts Seed Phrases

The component responsible for theft is called SeedHunter. After OkoBot establishes itself, SeedHunter watches for Trezor Suite, Ledger Wallet, or Ledger Live. When it finds one, it injects into the process, hooks the app's Electron internals, and checks in with its command-and-control server at moonsand[.]store.

Depending on a flag the server sets, the behaviour splits two ways. With the Wait flag active, SeedHunter scans USB by vendor and product ID and does nothing until a real Ledger or Trezor device is physically plugged in. Then it draws a fake recovery page, with a distinct layout per brand, inside the legitimate running application. With the flag off, the page appears straight away.

What the user sees is their normal wallet software, open and running. The fake page lives inside it. Anything typed goes to a console handler marked @:app:print, captured by a hooked function called mal_LogConsoleMessage, exfiltrated as JSON, with an RC4-encrypted copy dumped to a temp file.

The hardware wallet itself is not compromised. A Ledger or Trezor does exactly what it was built to do: keep the private key locked inside. It just cannot stop its companion desktop software from being manipulated into asking you to hand over your seed phrase.

Not the First Time, But a Different Approach

Injecting fake recovery prompts into wallet software is not a new trick. Moonlock Lab previously documented macOS stealers swapping out wallet apps, and separate reporting covered trojanised Ledger Live clones on macOS that killed the real app, dropped a fake one into /Applications, and demanded the 24-word recovery phrase.

On Windows, a piece of malware called GlassWorm used WMI to detect USB device insertion, killed the legitimate wallet app, and threw up its own window. SeedHunter takes a subtler path. The legitimate application keeps running. The fake page is drawn inside it, which makes the whole thing considerably harder to spot.

How It Gets In

OkoBot arrives through two main routes: ClickFix lures, and trojanised software pushed through GitHub repositories. Kaspersky found one repo advertising SQL Server Management Studio that was actually shipping Audacity, the open-source audio editor, rebuilt with a malicious payload buried inside one of its libraries. It ranked at the top of search results for SSMS. It ran from late March to June 2025.

Both entry points execute TookPS, a PowerShell downloader Kaspersky has been tracking since March 2025, when it was riding fake DeepSeek pages and bogus business software download sites. TookPS installs SSH, connects to an attacker-controlled server, forwards the local SSH daemon port, and waits for an automated bot to connect back through the tunnel.

Once in, the bot takes a full inventory of the machine, including installed antivirus software, then extracts wallet files, cookies, browser profiles, and credentials through the tunnel. It suppresses Windows Defender notifications via a registry write, then sets about making itself comfortable:

- Opens the firewall for inbound RDP
- Adds an account to the Remote Desktop Users group
- Replaces termsrv.dll with a patched build that allows concurrent RDP sessions
- Registers a scheduled task called Apple Sync that rebuilds a reverse SSH tunnel to the local RDP port every hour

After that, additional modules arrive over SFTP. A VMProtect-packed launcher called HDUtil runs them and can silently elevate privileges through a Windows RPC UAC bypass that Google Project Zero documented back in 2019. The final payload is delivered through Volume2, an open-source audio utility carrying a malicious protobuf.dll that decrypts and starts a plugin dispatcher polling its C2 every 20 seconds. Kaspersky recovered five plugins, one of which is a process injector responsible for placing SeedHunter inside wallet applications.

The Surveillance Stack

The rest of the kit is built for surveillance. OkoSpyware monitors over 100 executables, including Exodus and 1Password, recording matched windows to MP4 using a bundled FFmpeg instance alongside keystroke logging. Browser tab titles are regex-matched, so a MetaMask or Tonkeeper tab triggers recording. MC Keylogger handles input, clipboard, USB device monitoring, and takes a screenshot every five minutes.

A loader installs hidden Chromium extensions with every permission granted. The extension installed is Rilide, a Chromium-based credential stealer linked to Russian-speaking threat actors since at least April 2023, distributed through invitation-only Russian-language forums.

Attribution: Soft Signals Only

Kaspersky stops short of naming any known actor. The first-stage PowerShell servers return empty responses to Russian and CIS IP addresses. The SeedHunter phishing pages contain Russian-language comments. The report treats these as indicators, not conclusions.

What to Hunt For

There is no CVE here and no patch from Ledger or Trezor that closes this. The attack lands on the endpoint, and the artifacts are specific enough to search for:

- A scheduled task named Apple Sync
- %PROGRAMDATA%\hwid.dat, %PROGRAMDATA%\HDVideo\HDUtil.exe, %USERPROFILE%\.ssh\go.bat
- termsrv.dll modified from its original shipped build
- Remote Desktop Users accounts that nobody recognises adding
- Outbound SSH connections from user endpoints
- Extensions present in Local Extension Settings that do not appear in the browser's extension manager

Kaspersky's full post includes hashes and C2 domains.

Both Ledger and Trezor are clear that recovery phrases should never be entered into software on a PC. Trezor Suite will not ask you to type your backup phrase unprompted. On a Model One, standard recovery does accept words through Suite, but only when the device itself initiates the process with a corresponding prompt on its own screen. A recovery page that appears because you plugged a device in, with nothing showing on the device display, is the tell.

One detail worth noting from the report: Kaspersky observed a codebase refactor dated March 2026, where the HDUtil-to-extl-to-Rilide chain was collapsed into a single dispatcher plugin doing the same job, and Volume2 now arrives directly through TookPS. Nobody cleans up a codebase they are planning to abandon.