OkoBot Malware Framework Injects Seed Phrase Phishing Into Ledger and Trezor Apps

Back Thehackernews

OkoBot Malware Framework Injects Seed Phrase Phishing Into Ledger and Trezor Apps

Thehackernews • July 15, 2026

Share: View original

Learn how to secure AI agents with practical controls for access, visibility, secrets, and risk containment.

Learn how to govern risk, secure AI-built software, and keep control as development moves at machine speed.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

OkoBot Malware Targets Cryptocurrency Users to Steal Seed Phrases The OkoBot malware framework has been identified as a significant threat to cryptocurrency users, specifically targeting Ledger and Trezor wallets. This multi-stage malware captures sensitive information, including recovery phrases, browser credentials, wallet files, keystrokes, screenshots, and application video recordings. Researchers first detected OkoBot's activity in January 2026, but its TookPS downloader component has been operational since March 2025. The malware injects phishing mechanisms directly into Ledger and Trezor applications, making it particularly dangerous for users of these wallets. The full scope of the impact is still being assessed, but the potential for significant financial loss is high. Users are urged to remain vigilant and implement security measures to protect their assets. 20 sources 65

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (1)

T1566 - Phishing