Skip to content
CertGPS

OkoBot Malware Framework

A new malicious framework called OkoBot is delivering more than 20 payloads in attacks focused on stealing cryptocurrency wallet seed phrases, credentials, and other sensitive data.

Severity awaiting reviewZero daySecurity feature
Incident date
Published
Read time
8 min
C
CertGPS

Not independently reviewed

AI-assisted content. Editorial policy · Suggest a correction

View source
On this page

Note: This analysis is based on publicly available information from source article. Facts are clearly separated from technical analysis.

Executive Summary

The OkoBot Malware Framework incident is a significant security threat that has been ongoing for over a year. The campaign, which started in March 2025, has been observed to deliver 20 payloads and has affected multiple companies, including Kaspersky, a leading cybersecurity firm. The malware framework has been used to target various systems, including Windows devices, and has been found to collect sensitive information such as cryptocurrency wallet files, browser cookies, and account credentials. The incident highlights the importance of robust security measures and the need for continuous monitoring and detection.

The OkoBot campaign has been particularly concerning due to its ability to evade detection and its sophisticated tactics. The malware framework has been designed to inject malicious extensions into Chrome browsers and steal wallet recovery phrases, providing full access to a user's cryptocurrency assets. The incident also underscores the need for security professionals to stay vigilant and up-to-date with the latest threats and technologies.

What Happened: Timeline

✅ Verified Facts

The OkoBot activity was first observed in January 2026. However, the campaign is believed to have started in March 2025, with the TookPS campaign. The malware framework has been ongoing for over a year, with Kaspersky researchers noting that the campaign has evolved from the activity that delivered the malicious PowerShell script TookPS.

TimeEvent
January 2026OkoBot activity was first observed
March 2025TookPS campaign started
July 16, 2026 03:09 PMArticle published

Technical Deep Dive

Understanding OkoBot Framework

What is it?

The OkoBot framework is a sophisticated malware framework designed to deliver 20 payloads and target various systems, including Windows devices. The framework is designed to collect sensitive information such as cryptocurrency wallet files, browser cookies, and account credentials.

How does it work?

The OkoBot framework works by using ClickFix attacks or malicious GitHub repositories to reach victims. Once a victim is compromised, the SSH bot collects system details, disables Windows Defender notifications, and harvests cryptocurrency wallet files, browser cookies, and account credentials. The framework also includes ext daemon/extl.exe, which injects into Chrome browsers to install and hide malicious extensions. Additionally, SeedHunter injects into Trezor Suite, Ledger Wallet, and Ledger Live to steal wallet recovery phrases.

Security considerations

The OkoBot framework is a significant security threat due to its ability to evade detection and its sophisticated tactics. The framework's use of ClickFix attacks and malicious GitHub repositories makes it difficult to detect, and its ability to collect sensitive information makes it a significant concern for security professionals.

The SSH bot is a key component of the OkoBot framework, responsible for collecting system details, disabling Windows Defender notifications, and harvesting cryptocurrency wallet files, browser cookies, and account credentials. The SSH bot is designed to be stealthy and evasive, making it difficult to detect.

Ext daemon/extl.exe is a component of the OkoBot framework that injects into Chrome browsers to install and hide malicious extensions. This technology is designed to be sophisticated and stealthy, making it difficult to detect.

Analysis: What Went Wrong

📊 Professional Analysis

Technical Root Cause

The technical root cause of the OkoBot incident is the use of sophisticated malware framework that is designed to evade detection and collect sensitive information. The framework's use of ClickFix attacks and malicious GitHub repositories makes it difficult to detect, and its ability to collect sensitive information makes it a significant concern for security professionals.

Contributing Factors

The contributing factors to the OkoBot incident include the lack of robust security measures and the need for continuous monitoring and detection. The incident also highlights the importance of staying vigilant and up-to-date with the latest threats and technologies.

Lessons for Security Professionals

Key Takeaways

  1. Stay vigilant and up-to-date with the latest threats and technologies. The OkoBot incident highlights the importance of staying informed and up-to-date with the latest threats and technologies.
  2. Implement robust security measures. The incident highlights the need for robust security measures, including continuous monitoring and detection.
  3. Monitor for suspicious activity. The incident highlights the importance of monitoring for suspicious activity, including ClickFix attacks and malicious GitHub repositories.

Prevention & Detection

How to Prevent

  • Implement robust security measures, including continuous monitoring and detection.
  • Stay vigilant and up-to-date with the latest threats and technologies.
  • Monitor for suspicious activity, including ClickFix attacks and malicious GitHub repositories.

How to Detect

  • Use advanced threat detection tools, including machine learning and artificial intelligence.
  • Monitor for suspicious activity, including ClickFix attacks and malicious GitHub repositories.
  • Implement continuous monitoring and detection.
View related certification topics

Security+

  • Security and Risk Management: The OkoBot incident highlights the importance of security and risk management, including the need for robust security measures and continuous monitoring and detection.
  • Threats and Vulnerabilities: The incident highlights the importance of staying informed and up-to-date with the latest threats and technologies.

CySA+

  • Security Operations: The OkoBot incident highlights the importance of security operations, including the need for continuous monitoring and detection.
  • Threat Intelligence: The incident highlights the importance of threat intelligence, including the need to stay informed and up-to-date with the latest threats and technologies.

CISSP

  • Security and Risk Management: The OkoBot incident highlights the importance of security and risk management, including the need for robust security measures and continuous monitoring and detection.
  • Threats and Vulnerabilities: The incident highlights the importance of staying informed and up-to-date with the latest threats and technologies.

OSCP

  • Penetration Testing: The OkoBot incident highlights the importance of penetration testing, including the need to identify and exploit vulnerabilities.
  • Threat Intelligence: The incident highlights the importance of threat intelligence, including the need to stay informed and up-to-date with the latest threats and technologies.

CISM

  • Information Security Governance: The OkoBot incident highlights the importance of information security governance, including the need for robust security measures and continuous monitoring and detection.
  • Risk Management: The incident highlights the importance of risk management, including the need to identify and mitigate risks.

CISA

  • Information Systems Security: The OkoBot incident highlights the importance of information systems security, including the need for robust security measures and continuous monitoring and detection.
  • Risk Management: The incident highlights the importance of risk management, including the need to identify and mitigate risks.

GSEC

  • Security and Risk Management: The OkoBot incident highlights the importance of security and risk management, including the need for robust security measures and continuous monitoring and detection.
  • Threats and Vulnerabilities: The incident highlights the importance of staying informed and up-to-date with the latest threats and technologies.

CSSLP

  • Security and Risk Management: The OkoBot incident highlights the importance of security and risk management, including the need for robust security measures and continuous monitoring and detection.
  • Threats and Vulnerabilities: The incident highlights the importance of staying informed and up-to-date with the latest threats and technologies.

GCP Security

  • Cloud Security: The OkoBot incident highlights the importance of cloud security, including the need for robust security measures and continuous monitoring and detection.
  • Threat Intelligence: The incident highlights the importance of threat intelligence, including the need to stay informed and up-to-date with the latest threats and technologies.

CCNP Security

  • Security and Risk Management: The OkoBot incident highlights the importance of security and risk management, including the need for robust security measures and continuous monitoring and detection.
  • Threats and Vulnerabilities: The incident highlights the importance of staying informed and up-to-date with the latest threats and technologies.

OCI Security

  • Cloud Security: The OkoBot incident highlights the importance of cloud security, including the need for robust security measures and continuous monitoring and detection.
  • Threat Intelligence: The incident highlights the importance of threat intelligence, including the need to stay informed and up-to-date with the latest threats and technologies.

CPTS

  • Security and Risk Management: The OkoBot incident highlights the importance of security and risk management, including the need for robust security measures and continuous monitoring and detection.
  • Threats and Vulnerabilities: The incident highlights the importance of staying informed and up-to-date with the latest threats and technologies.

CDSA

  • Security and Risk Management: The OkoBot incident highlights the importance of security and risk management, including the need for robust security measures and continuous monitoring and detection.
  • Threats and Vulnerabilities: The incident highlights the importance of staying informed and up-to-date with the latest threats and technologies.

eJPT

  • Penetration Testing: The OkoBot incident highlights the importance of penetration testing, including the need to identify and exploit vulnerabilities.
  • Threat Intelligence: The incident highlights the importance of threat intelligence, including the need to stay informed and up-to-date with the latest threats and technologies.

eCPPT

  • Penetration Testing: The OkoBot incident highlights the importance of penetration testing, including the need to identify and exploit vulnerabilities.
  • Threat Intelligence: The incident highlights the importance of threat intelligence, including the need to stay informed and up-to-date with the latest threats and technologies.

PNPT

  • Penetration Testing: The OkoBot incident highlights the importance of penetration testing, including the need to identify and exploit vulnerabilities.
  • Threat Intelligence: The incident highlights the importance of threat intelligence, including the need to stay informed and up-to-date with the latest threats and technologies.

BTL1

Source (1)

This analysis is based on: https://www.bleepingcomputer.com/news/security/new-okobot-framework-deploys-20-payloads-to-steal-data-crypto/

This incident analysis is provided for educational purposes. Facts are cited from the source article, while technical analysis represents professional interpretation.