OkoBot Malware Framework Injects Seed Phrase Phishing Into Ledger and Trezor Apps

Kaspersky GReAT analyzed OkoBot, a multi-module Windows malware framework active since April 2025 that includes SeedHunter — a module which injects fake recovery pages into legitimate Ledger and Trezor desktop apps to capture seed phrases — and a suite of implants for credential and file theft, remote access (SSH tunnels, RDP persistence), and surveillance; the report includes IOCs and observable artifacts for hunting.