OkoBot Malware Uses ClickFix and SeedHunter to Steal Ledger and Trezor Seed Phrases

Gbhackers •Mayura Kathir • July 15, 2026

A newly documented malware framework dubbed OkoBot is targeting cryptocurrency users with a multi-stage intrusion chain designed to capture Ledger and Trezor recovery phrases, browser credentials, wallet files, keystrokes, screenshots, and application video recordings. Researchers first observed the activity in January 2026, although the campaign’s TookPS downloader component has been active since March 2025. The […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

OkoBot Malware Targets Cryptocurrency Users to Steal Seed Phrases The OkoBot malware framework has been identified as a significant threat to cryptocurrency users, specifically targeting Ledger and Trezor wallets. This multi-stage malware captures sensitive information, including recovery phrases, browser credentials, wallet files, keystrokes, screenshots, and application video recordings. Researchers first detected OkoBot's activity in January 2026, but its TookPS downloader component has been operational since March 2025. The malware injects phishing mechanisms directly into Ledger and Trezor applications, making it particularly dangerous for users of these wallets. The full scope of the impact is still being assessed, but the potential for significant financial loss is high. Users are urged to remain vigilant and implement security measures to protect their assets. 20 sources 65

Extracted Entities

OkoBot Malware Uses ClickFix and SeedHunter to Steal Ledger and Trezor Seed Phrases

The full story

Extracted Entities

Attack Types (1)

Malware (2)

MITRE ATT&CK (4)

Tools (2)