OkoBot Malware Uses ClickFix, Hidden Browser Extensions to Steal Crypto Data

**OkoBot** is an active, multi-stage malware campaign (identified by Kaspersky) that compromises Windows machines to steal cryptocurrency wallet files, seed phrases, browser-stored credentials, and record wallet application windows. The operation uses social-engineering ClickFix scams and malicious GitHub-distributed software to deliver a PowerShell loader (TookPS) that establishes SSH-based remote control, deploys screen/keylog capture (OkoSpyware), injects fake recovery UIs into hardware wallet apps (SeedHunter), installs hidden Chromium extensions, and implements persistence and RDP backdoors; it has infected hundreds of users across 25+ countries.