Loading malware…
OkoBot is a modular Windows malware framework focused on cryptocurrency theft, sensitive-data collection, surveillance, and persistent remote access. Active since April 2025 and identified in January 2026, it evolved from TookPS downloader campaigns into a four-stage operation incorporating more than 20 payloads and implants. Hundreds of victims were observed across more than 25 countries, with the largest concentrations in Brazil, Vietnam, Canada, Mexico, and Türkiye. No known threat group has been conclusively linked to the operation.
Initial infection uses ClickFix social-engineering lures and trojanized software hosted on GitHub. One campaign impersonated SQL Server Management Studio while distributing a modified Audacity build containing a malicious library. The TookPS PowerShell downloader installs and configures SSH tunneling, allowing an automated bot to inventory infected systems, harvest wallet files, browser profiles, cookies, and credentials, and deliver additional modules over SFTP. OkoBot maintains access through scheduled tasks and SSH tunnels, enables RDP access, and patches Windows terminal services to permit concurrent sessions. Its components support remote command execution, DLL side-loading, process injection, and optional UAC bypass. Defense-evasion behavior includes weakening Microsoft Defender settings, hiding malicious browser extensions, and deleting collected artifacts and PowerShell history after exfiltration.
SeedHunter injects into Trezor Suite, Ledger Wallet, and Ledger Live, hooks Electron functions, and presents wallet-branded recovery prompts to steal seed phrases, optionally waiting for a hardware wallet to connect. This compromises the host and abuses trust in companion software rather than exploiting the hardware wallet itself. OkoSpyware records targeted application windows and keystrokes across more than 100 applications, including cryptocurrency wallets and password managers. MC Keylogger captures keystrokes, clipboard contents, USB-device information, and periodic screenshots. Browser implants silently install and conceal malicious Chromium extensions, including Rilide in observed versions. A plugin dispatcher coordinates command execution, environment enumeration, payload deployment, and injection; a March 2026 revision consolidated portions of the earlier delivery chain.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
31 distinct techniques documented for this family, organized by ATT&CK tactic.
...with a scheduled task named “Apple Sync” reconnecting the machine to attackers every hour.
If the warning returns at a regular interval, Task Scheduler is the first place to correlate.
Its PowerShell command can fetch both a randomly named 7-Zip program and a randomly named payload, or download the payload directly.
ErrTraffic begins after someone reaches a compromised WordPress website. The injected JavaScript does not contain the final destination in clear text.
Instead of exploiting a software flaw, the page tells a visitor to copy and paste a supposed fix, often into the Windows Run box or PowerShell. | The campaign, tracked as ErrTraffic, turns hacked WordPress sites into launch points for fake verification prompts that persuade visitors to run harmful Windows commands. The trick is known as ClickFix.
...with a scheduled task named “Apple Sync” reconnecting the machine to attackers every hour.
If the warning returns at a regular interval, Task Scheduler is the first place to correlate.
...with a scheduled task named “Apple Sync” reconnecting the machine to attackers every hour.
If the warning returns at a regular interval, Task Scheduler is the first place to correlate.
For each match, a bundled FFmpeg instance records MP4 video of that window while logging keystrokes. A separate keylogger captures clipboard text
For each match, a bundled FFmpeg instance records MP4 video of that window while logging keystrokes. A separate keylogger captures clipboard text
For each match, a bundled FFmpeg instance records MP4 video of that window... and a screenshot every five minutes.
49 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Okobot is presented as a payload delivered by ErrTraffic that arrives via ZIP and malicious DLL files, attempts to disable or weaken Microsoft Defender protections, and tampers with LSASS protections to facilitate credential access.
Delivered through a ZIP containing legitimate Volume2 software and a malicious DLL. The observed chain adds Defender exclusions, changes security policies, configures SSH service persistence, removes the RunAsPPL registry value, and transmits host identifiers and usernames. The malicious DLL communicates with livewallpapers[.]cfd.
Referenced only as a comparative example involving hidden PowerShell and deceptive scheduled tasks.
A multi-stage malware framework used to steal cryptocurrency wallet data and provide full remote control on victim machines. It harvests wallet files, browser cookies, and credentials, enables RDP access, deploys additional modules over SFTP, and supports seed phrase phishing, keylogging, screen recording, and clipboard/screenshot theft.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.