New OkoBot Malware Framework Discovered Stealing Cryptocurrency

Cybersecurity specialists have discovered a new malware framework dubbed OkoBot. According to available data, threat actors are using it to deploy more than 20 different payloads in attacks aimed at stealing sensitive information.

What we know about the attacks

The primary target of OkoBot's operators is cryptocurrency wallet seed phrases — the secret sequences of words that allow a wallet to be recovered and the funds stored in it to be controlled. In addition, the framework harvests user credentials and other sensitive information.

The multiplicity of payloads it uses indicates that OkoBot is not a single malicious sample but a full-fledged modular platform, allowing attackers to flexibly combine tools depending on the goals of a specific attack.

Why it matters

Seed phrase theft remains one of the most dangerous scenarios for cryptocurrency owners: unlike passwords, a compromised seed phrase cannot be reset or changed — an attacker who gains access to it can immediately and irreversibly drain all the funds from the wallet.

The emergence of specialized, multi-functional frameworks like OkoBot points to the ongoing professionalization of cybercrime in the area of attacks on cryptocurrency users. Having a broad set of modules lets the operators of such tools tailor their attacks to different categories of victims and types of stolen data.

Users who work with cryptocurrency assets should exercise heightened caution: do not store seed phrases digitally on internet-connected devices, use hardware wallets, and carefully verify the source of any software before installing it.

Source: Bleeping Computer