Oko Bot Malware Framework Injects Seed Phrase Phishing Into Ledger and Trezor Apps

Summary: Kaspersky's GReAT team published a teardown of OkoBot, a Windows malware framework active since April 2025 that carries more than 20 payloads and implants, with a module called SeedHunter that injects into Trezor Suite, Ledger Wallet, and Ledger Live and draws a hard-coded recovery-phrase page inside the running app. Kaspersky counted hundreds of victims across more than 25 countries, with the largest share in Brazil, Vietnam, Canada, Mexico, and Türkiye, and the framework was still active as of the July 15 report.
Key Takeaway: The hardware wallet does its job and refuses to give up the key, but the companion software on an infected PC asks for the phrase instead, and there is no wallet CVE or vendor patch that closes this route. Kaspersky recovered five plugins, including a process injector and surveillance tools that film windows for Exodus and 1Password and log keystrokes, and the report does not say how many of the hundreds of victims typed a phrase in.

Read the original at The Hacker News ↗