A malware framework called OkoBot has been running on Windows machines since April 2025, and one of its modules is built to con hardware wallet owners out of their recovery phrase.
On an infected PC, the request comes from inside the wallet’s own desktop software. Sometimes it waits until you plug the device in first. The page is malicious. The app around it is the real one you installed, and the phrase is the wallet.
Kaspersky’s GReAT team published the teardown on Wednesday, counting hundreds of victims in its telemetry across more than 25 countries. The largest share of attacked users is in Brazil, Vietnam, Canada, Mexico, and Türkiye.
How many of them typed a phrase in, the report does not say. OkoBot carries more than 20 payloads and implants and was still active as of the July 15 report.
SeedHunter Waits for the Device
SeedHunter is the OkoBot module that steals the phrase. Once the framework lands, it watches for Trezor Suite, Ledger Wallet, and Ledger Live, injects into whichever it finds, and hooks the app’s Electron internals. Then it asks its C2 at moonsand[.]store.
If the server sets a Wait flag, SeedHunter scans USB by vendor and product ID and sits still until a real Ledger or Trezor is plugged in. Only then does it draw a hard-coded recovery page, one layout per brand. With the flag off, the page appears immediately. The typed phrase goes to the page’s own console behind an @:app:print marker, and the hooked mal_LogConsoleMessage picks it up. It leaves as JSON, with an RC4 copy dropped in a temp file.
The hardware wallet is not what gets broken. It does the one thing it was built for, which is to refuse to give up the key, and it cannot stop its companion software from asking you for the phrase instead.
Neither half of the trick is new. Moonlock Lab tracked macOS stealers doing the swap version, and THN covered those cloned Ledger Live apps: AMOS killed Ledger Live and dropped a trojanized clone in /Applications demanding the 24 words.
GlassWorm did the USB trigger on Windows in March, using WMI to spot a device going in, then throwing its own window up after killing the real app. What SeedHunter changes is where the page gets drawn. It leaves the app running and draws inside it.
The SSMS That Was Actually Audacity
Two main ways in: a ClickFix lure, and trojanized software on GitHub. The repo Kaspersky pulled apart advertised SQL Server Management Studio. What it shipped was Audacity, the audio editor, rebuilt with a malicious implant inside one of its libraries. It ranked top for SSMS. It lived from late March 2025 to June.
Both paths execute TookPS, a PowerShell downloader Kaspersky has tracked since March 2025, when it rode fake DeepSeek pages, then fake business-software download sites. It installs SSH, dials an attacker-controlled server, forwards the local SSH daemon port, and waits. Later, an automated SSH bot connects back through the tunnel.
The bot inventories the box down to the installed AV, then drags wallet files, cookies, browser profiles, and credentials out through the tunnel. It silences Defender notifications with a registry write and builds itself a desk:
- Opens the firewall for inbound RDP
- Adds an account to the Remote Desktop Users group
- Replaces
termsrv.dllwith a patched build that permits concurrent RDP sessions - Registers a scheduled task called
Apple Syncthat rebuilds a reverse SSH tunnel for the local RDP port every hour
Modules arrive over SFTP after that. A VMProtect-packed launcher called HDUtil runs them and can elevate them silently through a Windows RPC UAC bypass that Project Zero documented in 2019.
The last delivery is Volume2, an open-source utility carrying a malicious protobuf.dll that decrypts and starts the real payload: a plugin dispatcher polling its C2 every 20 seconds. Kaspersky recovered five plugins. One is a process injector, and that is what puts SeedHunter in place.
The rest of the kit is surveillance. OkoSpyware watches for 100-plus executables, Exodus, and 1Password among them. It films the matching window to MP4 with a bundled FFmpeg and logs keystrokes into it.
Browser titles get regex-matched, so a MetaMask or Tonkeeper tab gets recorded. MC Keylogger covers input, clipboard, USB devices, and takes a screenshot every five minutes. A loader installs hidden Chromium extensions with every permission granted; Rilide, a Chromium stealer used by Russian-speaking threat actors since April 2023, is what it installed.
Whose Framework Is It?
Kaspersky will not name an actor: “we can’t attribute this malicious campaign to any known crimeware actor.” The servers hosting the first-stage PowerShell return an empty response to Russian and CIS IPs. Rilide moves on invitation-only Russian-speaking forums.
The SeedHunter phishing pages carry Russian comments. Those are soft signals, and the report treats them as such.
There is no wallet CVE and no vendor patch that closes this route. It lands on the endpoint instead, and the artifacts are specific enough to hunt:
- A scheduled task named
Apple Sync %PROGRAMDATA%hwid.dat,%PROGRAMDATA%HDVideoHDUtil.exe,%USERPROFILE%.sshgo.battermsrv.dllaltered from its shipped build- Accounts in Remote Desktop Users that nobody added
- Outbound SSH from user endpoints
- Extensions in
Local Extension Settingsthat never appear in the browser’s extension list
Kaspersky’s post has the hashes and C2 domains. The vendors draw the line at the device. Ledger says the phrase never goes anywhere but the Ledger itself.
Trezor Suite says it will never ask you to type your backup, though a Model One’s standard recovery does take the words in Suite, and only when the device asks. A page that appears because you plugged in, with nothing on the device screen behind it, is the tell.
Then the March 2026 rebuild. TeviRAT is gone. The HDUtil to extl to Rilide chain is gone, folded into a single dispatcher plugin that does the same job. Volume2 now comes straight from TookPS. Nobody prunes a codebase they are about to walk away from.
