OkoBot malware: fake hardware-wallet recovery screens steal seeds
Kaspersky researchers detailed OkoBot, a modular malware platform. Its SeedHunter module detects popular hardware-wallet software and shows fake recovery screens to harvest seed phrases.
Delivery often uses social-engineering “fix this error” prompts and trojanized installers.
369 take
Never type a seed phrase into any on-screen prompt: not even one that looks like Ledger or Trezor. Hardware recovery stays offline.
Seedless wallets remove that Notes/Keychain target, but malware can still abuse unlocked sessions: keep devices clean and ignore “run this command” fixes.
Sources