Loading story…
Researchers reported that the OkoBot malware framework has been actively compromising users since 2025 through ClickFix social-engineering lures and trojanized software hosted on GitHub, then establishing SSH-based access to infected machines. The framework, described as an evolution of the TookPS campaign, delivers more than 20 payloads for persistence, remote command execution, credential theft, browser-extension abuse, and cryptocurrency theft, with observed victims spanning more than 25 countries and the highest concentrations in Brazil, Vietnam, Canada, Mexico, and Türkiye.
The operators use modules including HDUtil, SeedHunter, MC Keylogger, OkoSpyware, and a malicious browser-extension loader to steal wallet files, browser data, credentials, screenshots, clipboard contents, and recordings of wallet or password-manager windows. Investigators said the campaign specifically targets cryptocurrency users by phishing for hardware-wallet seed phrases and abusing browser extensions to capture sensitive data, while infrastructure and code artifacts—including geoblocking of Russia/CIS IP space, use of the Rilide extension, and Russian-language comments—suggest links to Russian-speaking cybercriminals, though attribution remains unconfirmed.
Pull IOCs and campaign context straight into your stack.
7 events from the most recent confirmed update back to the earliest known activity.
Kaspersky disclosed that OkoBot includes a SeedHunter module that hooks Trezor Suite, Ledger Wallet, and Ledger Live to inject fake recovery-phrase pages inside the legitimate applications. The module can wait until a real Ledger or Trezor device is connected before prompting victims, showing the campaign specifically targets cryptocurrency hardware wallet users via endpoint compromise rather than a wallet vulnerability.
Securelist reported that OkoBot was still active as of mid-2026, with hundreds of victims observed across more than 25 countries. The report also described the framework's SSH-based access, wallet-targeting modules, and indicators suggesting possible Russian-speaking cybercriminal involvement.
Securelist reported that the OkoBot malware framework, an evolved TookPS-based campaign, has been operating since 2025. The campaign uses ClickFix lures and trojanized GitHub-hosted software to infect victims and deploy numerous payloads for persistence, credential theft, and cryptocurrency theft.
James Forshaw described new Sandbox Analysis Tools capabilities for interacting with Windows Local RPC servers from managed .NET code and demonstrated a previously undocumented UAC bypass via the APPINFO service's hidden UAC RPC interface.
In January 2026, investigators detected multiple attacks using the OkoBot malware framework to steal cryptocurrency wallet data. The campaign used a four-stage infection chain initiated by a malicious PowerShell script, coordinated more than 20 payloads over an SSH tunnel, and the report published related IOCs and detection queries.
Researchers reported that in early 2025, multiple campaigns impersonated DeepSeek with fake websites and bogus desktop clients to deliver a Python stealer, SSH-enabling PowerShell payloads, a KCP-tunneling backdoor, and a Farfli backdoor variant. The lures were distributed via typosquatted domains and social media posts, and some infrastructure used geofencing or targeted Chinese-speaking users.
Securelist reported that attackers distributed the TookPS downloader via fake and pirated-software lures impersonating UltraViewer, AutoCAD, SketchUp, Ableton, and Quicken, targeting both individuals and organizations. The report said TookPS fetched PowerShell payloads that established SSH tunnels and deployed additional malware including a modified TeviRat sample and Lapmon.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 79 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
12 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcexakep.ru
Open sourcehackread.com
Open sourcebleepingcomputer.com
Open sourcemoonlock.com
Open sourcesecurelist.com
Open sourcesecurelist.com
Open sourcegoogleprojectzero.blogspot.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported multiple **ClickFix** campaigns using fake CAPTCHA or reCAPTCHA prompts to trick users into manually running malicious commands, with payloads tailored by platform and victim profile. On Windows, one campaign delivered a modular NodeJS-based RAT and infostealer through a malicious MSI installer, loading key capabilities only in memory after command-and-control was established and using `gRPC` over Tor for persistent communications. An operational security failure exposed the malware’s backend protocol definitions and admin panel API, revealing a malware-as-a-service operation with multi-operator support, Telegram alerts, automation rules, and cryptocurrency wallet tracking. The malware also fingerprinted victims extensively and established persistence through the Windows Run registry key as **LogicOptimizer**. A separate ClickFix chain attributed with high confidence to **Grandoreiro** targeted users of eight Brazilian banks by luring victims through a fake reCAPTCHA page and launching a malicious PowerShell sequence that sideloaded a Delphi banking trojan with legitimate GoToMeeting and Nero binaries. The malware deployed banking overlays, intercepted **PIX** QR-code payments, added Microsoft Defender exclusions, and stole credentials, device information, signatures, and payment confirmation codes. Netskope also documented a macOS variant that used AppleScript and a persistent fake password dialog to harvest Keychain data, browser cookies, saved credentials, extension storage, and cryptocurrency wallet data; the theft of live session cookies can enable attackers to bypass MFA by hijacking authenticated sessions.
Jun 29, 2026
Security researchers and Italy’s national cyber agency warned of active **ClickFix** and **TerminalFix** malware campaigns that trick users into manually launching malicious Windows commands from fake CAPTCHA or verification pages. The activity relies on compromised legitimate websites, including WordPress sites, where obfuscated JavaScript redirects visitors to prompts telling them to open **Run**, **Windows Terminal**, or **PowerShell** and paste attacker-supplied commands. Those commands abuse trusted Windows utilities such as `powershell.exe`, `cmd.exe`, `mshta.exe`, `rundll32.exe`, `msiexec.exe`, `curl.exe`, WMI, WebDAV, and scheduled tasks to download follow-on payloads, establish persistence, and contact attacker infrastructure. Researchers said the operators are using **EtherHiding** to conceal parts of their delivery chain inside smart contracts on public blockchains, including **BNB Smart Chain** and **Polygon**, which are queried through RPC gateways to retrieve configuration or malicious instructions. WatchGuard linked one cluster to the **ErrTraffic** malware-as-a-service operation and reported delivery of payloads including **Vidar**, **Okobot**, **ClipBanker** variants, **BabaDedaLoader**, Node.js backdoors, OnionDrop-related malware, and LegionLoader-linked samples. The campaign is aimed at credential theft, browser and cookie harvesting, cryptocurrency-wallet theft, defense evasion, lateral movement, and staging for broader compromise, prompting defenders to tighten command-line controls, increase PowerShell and endpoint monitoring, isolate affected hosts, and reset exposed accounts.
Aug 11, 2026
Cisco Talos identified a months-long **ClickFix** cryptocurrency-theft campaign that tricks users into injecting malicious JavaScript into Chrome or installing it through Tampermonkey. Lures impersonate leaked reports of cryptocurrency-exchange API flaws and promise SwapZone or SimpleSwap trading bonuses. The scripts use Google Sheets and the Google Visualization API for command-and-control, hiding second-stage retrieval within trusted `docs.google.com` traffic, then replace cryptocurrency deposit addresses in webpages, intercepted responses, and the clipboard. Talos linked 49 Bitcoin wallets to the operation; 24 active wallets received 0.159 BTC, roughly $10,000 in early August 2026. ClickFix techniques continue to enable broader malware delivery as well as browser-based theft. A blocked July 2026 intrusion used phishing to induce in-memory PowerShell execution, followed by a loader, process injection into `svchost.exe` or `explorer.exe`, and deployment of PureLogs Stealer targeting browser credentials, cookies, banking data, and cryptocurrency wallets. Earlier activity tracked by Proofpoint showed ClearFake and TA571 using fake browser or certificate warnings and malicious clipboard content to persuade victims to manually run PowerShell, delivering stealers, RATs, loaders, and cryptominers. Organizations should treat unexpected browser verification prompts and copy-paste instructions as high-risk, while monitoring for browser script injection, anomalous Google-hosted script retrieval, and credential or wallet-address manipulation.
Sep 9, 2026