New OkoBot framework deploys 20 payloads to steal data, crypto

OkoBot is a multi-stage malicious framework observed by Kaspersky that has been active for over a year and uses ClickFix attacks and trojanized GitHub repositories to deliver more than 20 payloads aimed at stealing cryptocurrency wallet seed phrases, credentials, cookies and other sensitive data; notable modules include SeedHunter (wallet seed theft), ext daemon (browser extension injection), MC Keylogger and OkoSpyware, and the campaign has global victims (notably Brazil) with provided IOCs and telemetry.