SeedHunter OkoBot the trap that turns the purse interface into seed theft

A new malware frame identified as OkoBot has once again shown that the greatest weakness in cryptomoneda security is not the chip of a physical purse but the operating system around the user. Kaspersky researchers described in July 2026 a specific module, named SeedHunter, aimed at persuading physical purse owners to write their recovery phrase within the manufacturer's own legitimate desktop software, and thus steal words as if it were a normal screen capture or a keylogger. The danger is not that the physical device fails, but that the legitimate interface of the software becomes the window that requests and delivers the seed to the attacker.

The technique is remarkable for its subtlety: SeedHunter injects code into desktop applications (Trezor Suite, Ledger Live or variants) and draws a "recovery" page within the real client you installed. In some cases wait for the device to be connected before showing the page, which increases the illusion that the hardware is requesting the phrase. When the victim writes the 12, 18 or 24 words, the module captures that input and exfilters it as JSON, leaving even an encrypted copy in a temporary file. Fraud takes advantage of confidence in official software and the fact that many users already agree to write the phrase on the computer when the process seems to come from the purse itself.

OkoBot is not limited to that single trick: it is a modular platform with more than twenty components that include PowerShell (TookPS) downloads, reverse SSH tunnels, browser credentials theft, video recording of windows that match patterns (MetaMask, Tonkeeper), keyloggers and installing malicious Chromium extensions like Riide. The attackers have used vectors as varied as GitHub-cut repositories that promised business software and clickFix that run the malicious code. The engagement can become a persistent back door for remote control, exfiltration and deployment of new modules.

The implications are clear: even if the physical purse continues to work and denies the private key, the accompanying software and the host system can deceive the user to deliver the seed. Therefore, the security of a hardware portfolio is assessed not only for its physical or cryptographic resistance, but also for the complete chain: the computer, updates, third-party libraries and user hygiene. Kaspersky reported victims in more than 25 countries, with concentrations in Brazil, Vietnam, Canada, Mexico and Türkiye, and noted signs of possible overlap with Russian-speaking communities without conclusively attributing the campaign to a known actor.

For users and managers who want to reduce risk, there are concrete and verifiable measures. First of all, never enter the recovery phrase into a computer or desktop software unless the device screen explicitly and verifiably requests it; the practical rule is to always look at the physical screen of the purse before typing any word. Reinstall the application of the purse from the official website and validate signatures when available helps to avoid stranded binaries; in addition, keep the operating system up to date, have EDR / antivirus enabled and restrict remote access services such as RDP prevents easy escalation of the attacker.

If you suspect an infection, there are artifacts that Kaspersky has identified as useful indicators for endpoint hunting: tasks programmed with suspicious names such as "Apple Sync," files in% ProgrammDATA% like hwid.dat or routes such as% ProgrammDATA%\\ HDVideo\\ HDUtil.exe, presence of% USERPROFILE%\\\ .ssh\ go.bat, modifications of the termsrv.dll file, unexpected accounts in the group Remote Desktop Users, outgoing SSH tunnels from the local site that appear in the UI and non-malicious extensions in the browser. In the face of an evidence of commitment, it is prudent to isolate the machine, collect indicators for response and consider a complete reinstallation of the operating system because the attackers leave doors that are difficult to close completely from the committed team itself.

From the operational point of view, organizations must audit the software sources their employees use: attackers continue to exploit trust in GitHub and other repositories to distribute stranded installers. Security teams should alert about unusual behaviors such as processes that start PowerShell downloads, outgoing SSH tunnels and firewall or record modifications that silence security alerts. Network segmentation and the restriction of outgoing ports (e.g., blocking outgoing SSH to unapproved destinations) limit the attacker's ability to establish persistent channels.

Manufacturers remember the basic rule: the physical purse cannot filter its seed by itself. Ledger points out that the phrase does not leave the device, and Trezor stresses that your software should not order the seed except in processes where the device screen confirms it. If you see a page that asks for the seed without physical confirmation on the device screen, do not write it and immediately disconnect the network equipment. Useful links to verify good practices and official procedures are available on the manufacturers' pages and in incident response resources: you can consult the security documentation of Trezor at https: / / trezor.io / security / and Ledger's support guides in https: / / support.ledger.com /. For a technical context and IoC search, the Kaspersky team keeps publications and blog entries on its general site https: / / www.kaspersky.com /.

In short, SeedHunter and the OkoBot platform represent a natural evolution of digital thieves' techniques: combining social engineering with injection into legitimate processes turns any desktop app into a possible gateway. The best defense is to avoid introducing the seed into the computer, to strengthen the hygiene of the environment and to act quickly in the face of any signs of commitment.