OkoBot Malware Injects Seed Phrase Phishing Into Ledger and Trezor Apps

A malware framework dubbed OkoBot has been active on Windows systems since April 2025, using a module called SeedHunter to hijack legitimate hardware wallet software and steal user recovery phrases. According to a teardown published Wednesday by Kaspersky's GReAT (Global Research and Analysis Team), the campaign has already claimed hundreds of victims across more than 25 countries, with the heaviest concentration of infections reported in Brazil, Vietnam, Canada, Mexico, and Türkiye. SeedHunter targets three wallet applications — Trezor Suite, Ledger Wallet, and Ledger Live — by injecting malicious code directly into the apps' Electron internals. Because the phishing window is drawn inside the genuine, trusted application, users see what appears to be a legitimate prompt from software they personally installed.

SeedHunter's delivery mechanism is conditional and precise. Once embedded, the malware contacts its command-and-control server at moonsand[.]store and checks for a Wait flag. If the flag is set, SeedHunter performs a USB scan filtered by vendor and product ID, remaining dormant until a genuine Ledger or Trezor device is physically connected to the infected machine. Only at that moment does it render a hard-coded phishing page — with separate layouts tailored for each hardware wallet brand. Captured seed phrases are exfiltrated as JSON, with an RC4-encrypted copy staged in a temporary file before being shipped to the attacker's infrastructure. The hardware wallets themselves remain secure, doing exactly what they were designed to do — refuse to release the private key — but the surrounding desktop software is weaponized against the user. Security researchers investigating similar C2 infrastructure can run a WHOIS lookup on suspected domains like moonsand[.]store to assess registrant history and hosting patterns.

OkoBot's distribution relies on two primary infection chains. The first is a ClickFix social engineering lure, and the second is trojanized software hosted on GitHub. Kaspersky specifically analyzed a repository that advertised SQL Server Management Studio but actually delivered a repackaged version of Audacity, the open-source audio editor, with a malicious implant embedded in one of its libraries. The fake project had risen to the top search result for SSMS downloads and remained live from late March 2025 through June 2025. Both attack paths execute TookPS, a PowerShell downloader Kaspersky has tracked since March 2025 when it was first distributed through fake DeepSeek installer pages and counterfeit business-software download portals. TookPS installs OpenSSH, opens an SSH tunnel back to attacker-controlled infrastructure by forwarding the local SSH daemon port, and waits patiently for an automated SSH bot to connect through that tunnel.

The campaign's innovation lies not in any single technique but in the layered combination of familiar tradecraft. Moonlock Lab previously documented macOS stealers executing similar application-swap attacks, and earlier campaigns like AMOS and GlassWorm demonstrated comparable USB-triggered lures on Windows using WMI to detect device insertion. What sets SeedHunter apart is that the legitimate wallet application remains running and visible while the phishing overlay is rendered inside its own window — a more convincing deception than killing the app and presenting a clone. Users who suspect their machine may be compromised should validate outbound connections with a DNS leak test to confirm no unauthorized resolvers are active, and verify any suspected seed phrase exposure through our email breach checker as part of a broader incident response assessment.