OkoBot malware: fake hardware-wallet recovery screens steal seeds
Kaspersky researchers detailed OkoBot, a modular malware platform. Its SeedHunter module detects popular hardware-wallet software and shows fake recovery screens to harvest seed phrases. Delivery often uses social-engineering “fix this error” prompts and trojanized installers.
369 take: Never type a seed phrase into any on-screen prompt — not even one that looks like Ledger or Trezor. Hardware recovery stays offline. Seedless wallets remove that Notes/Keychain target, but malware can still abuse unlocked sessions — keep devices clean and ignore “run this command” fixes.