Kaspersky Uncovers OkoBot Malware Targeting Crypto Investors

Cybersecurity firm Kaspersky has discovered a new malware framework called OkoBot that targets cryptocurrency holders. Attackers spread it through social engineering and fake GitHub apps, and researchers first recorded attacks back in January 2026. The malware can drain a victim's wallet completely before the person notices anything suspicious.

What researchers found

In a report published on Wednesday, July 15, Kaspersky analysts described the OkoBot infection chain. Infection starts in one of two ways: the ClickFix technique, which tricks a person into pasting and running a malicious command disguised as tech support instructions, or trojanized GitHub apps that pose as legitimate crypto tools but actually deliver a backdoor to the device. Both scenarios rely on the victim taking the final step and running the malicious code themselves, bypassing most antivirus checks.

Once installed, the malware gains access to wallet files, browser data, and the victim's account credentials. OkoBot can inject malicious browser extensions and hijack wallet app windows to steal assets straight from an open user session. Researchers note the malware can identify which crypto tools are installed on a device and tailor the attack to that specific set of apps. That sets OkoBot apart from basic infostealers, which simply dump every file without discrimination.

Technical details and OkoBot's origin

Kaspersky has tracked waves of attacks from this malware family since the start of the year. According to researchers, OkoBot evolved from the TookPS campaign, which the company first described in 2025. Back then, attackers spread a trojan downloader through fake sites offering "free" software, mostly targeting users searching for pirated versions of popular programs.

The new version's key difference is orchestrating 20 malicious payloads at once through a single SSH tunnel. That setup lets attackers remotely move data from infected machines to their servers and control multiple tools simultaneously, without a separate connection for each module. To standard network filters, that traffic looks like ordinary SSH activity, so most corporate monitoring systems simply let it through. Kaspersky warns that this kind of architecture opens the door to copycat attacks, where other criminals replicate a successful scheme for their own campaigns. The company adds it has recorded several separate waves of this family's attacks since January, so the campaign's real scale is likely larger than officially confirmed cases.

Parallel campaigns against developers and traders

That same week, SlowMist reported a separate wave of attacks on Web3 developers through fake recruiting messages on LinkedIn. Attackers pose as recruiters, offer a job opening, and send candidates a link to a GitHub repository they supposedly need to run before the interview.

The scenario mimics an ordinary technical take-home assignment. The developer clones the code, installs dependencies, and runs the project. That's why the victim rarely suspects anything until the malicious module has already gained access to project keys, cloud credentials, and wallet extension files. SlowMist says the scenario's realism is exactly what makes the attack hard to spot even for experienced developers who clone other people's repositories every day. The attackers' end goal is installing a full remote access trojan that gives control over the developer's entire device, not just their crypto assets.

"This is not an isolated case. Attackers are increasingly using interview scenarios, code reviews, and joint projects to get developers to run a malicious repository themselves."

- SlowMist, report on phishing campaigns against Web3 developers, July 2026

A day earlier, SlowMist also described a separate malware campaign for macOS that hijacks Telegram sessions and tries to trick crypto holders into entering their seed phrase on fake websites. Researchers see a shared pattern here: instead of attacking the blockchain itself, attackers increasingly exploit a user's trust in familiar interfaces, whether it's Telegram, LinkedIn, or GitHub.

How to protect your wallet

Security specialists advise against running commands from unfamiliar instructions, even ones that look like official site support. Any GitHub repository is worth checking in an isolated environment, such as a virtual machine, before installing dependencies or running code on a primary device. Extra caution applies to anyone who regularly handles P2P deals or talks to exchanger "support" over messaging apps. The same trick of pasting a command into a terminal shows up in chats about a supposedly failed transfer, too.

• Don't paste commands from someone else's "fix the error" instructions into a terminal or Run window
• Verify repositories and recruiter contacts through a company's official channels, not just a LinkedIn profile
• Keep the bulk of assets in a hardware wallet like Ledger rather than a browser extension
• Never enter a seed phrase on a third-party site, even one that mimics the official app
• Update antivirus software and browser extensions only from official stores, not links sent in chats

Attacks like OkoBot confirm a simple point. Attackers increasingly target the person at the keyboard, not the blockchain itself. Wallets holding Bitcoin or Ethereum remain the top target precisely because the app on a computer is easier to break than the protocol itself.