OkoBot: new sophisticated malware framework targets cryptocurrency users

Kaspersky analysts describe OkoBot, a modular multi-stage crimeware framework initiated by the TookPS PowerShell downloader that establishes SSH tunnels to orchestrate payload delivery and exfiltration. The framework (over 20 payloads) includes browser-extension loaders, a SeedHunter module that phishes hardware-wallet seed phrases, a keylogger, screen/video capture (OkoSpyware), process injectors, and a plugin dispatcher; it employs UAC bypass, RDP persistence, VMProtect obfuscation, and encrypted in-memory implants. Hundreds of victims in 25+ countries were observed, with active C2 infrastructure and comprehensive IoCs provided.