ThreatVectr

OkoBot Malware Hijacks Ledger and Trezor Apps to Steal Crypto Recovery Phrases

A Windows malware framework active since April 2025 waits for victims to open their hardware wallet software, then fakes a prompt for the seed words that unlock everything.

ThreatVectr NewsdeskAI-assistedPublished Updated · Editor: Lee Brown· 4 min read
Illustration: a small metallic cryptocurrency hardware wallet plugged into a laptop USB port on a dark wooden desk
Illustration made with AI. Not a photograph of the events described.
Share

Key points

  • OkoBot is a Windows malware framework active since April 2025 that now targets cryptocurrency hardware wallets.
  • One OkoBot module injects a fake recovery-phrase prompt directly into the real desktop apps used by Ledger and Trezor wallet owners.
  • The malware sometimes waits until the victim physically plugs in their hardware wallet before showing the fake prompt, making it look legitimate.
  • Anyone who types their 12 to 24 word recovery phrase into that prompt hands the attackers full control of their crypto funds.
  • Hardware wallet makers have long warned that a genuine device will never ask for the recovery phrase inside a computer app.

A malware toolkit called OkoBot has been quietly running on Windows computers since April 2025, and its latest module is aimed at people who thought they were doing the safe thing with their cryptocurrency.

OkoBot is what researchers call a framework: a piece of malicious software that loads different modules for different jobs. One of those modules goes after owners of hardware wallets, the small USB devices made by companies like Ledger and Trezor that keep crypto offline. On an infected PC, the victim opens the real wallet app from the manufacturer. The app looks normal. OkoBot has injected a fake page into it asking for the recovery phrase, the string of 12 to 24 words that acts as the master key to the wallet.

Sometimes OkoBot waits, showing the fake prompt only after the victim plugs in the physical device. That timing is deliberate. It makes the request feel like a natural part of using the wallet.

Why would anyone type in their recovery phrase?

Because the request appears to come from software they trust. The app around the malicious page is the genuine one, installed from the real vendor. To an ordinary user, nothing looks wrong. The window has the right colours, the right logo, the right feel.

That's the whole point. Hardware wallets exist precisely so the recovery phrase never touches an internet-connected computer. The moment those words are typed into a PC, especially one already carrying malware, the wallet's protection is gone. An attacker with the phrase can rebuild the wallet on their own machine and drain the funds. We covered a related hardware-wallet threat on 10 July 2026, when Ledger's Donjon team demonstrated a laser attack on Tangem cards; the attack vector is different, but the lesson is the same: physical and software defences both have limits.

What crypto owners should do right now

The rule from both Ledger and Trezor hasn't changed, and this campaign is exactly why they repeat it. A genuine hardware wallet will never ask you to type your recovery phrase into a computer or a phone. Not during setup after the first time. Not to verify anything. Never.

If a wallet app on your PC shows a screen asking for those words, treat the computer as infected. Don't type the words in, don't photograph the screen. Move any funds using a clean device, then reset the infected machine.

How OkoBot arrives matters too. Frameworks like this typically spread through cracked software, fake installers, or phishing, where criminals send convincing emails to trick people into downloading something bad. Our 3 July 2026 story on ClickFix showed how social engineering now dominates malware delivery, and OkoBot fits that pattern. Sticking to official download sources and keeping Windows and antivirus tools current closes off most of those routes.

OkoBot is still being tracked, and the crypto-stealing module is one of several the framework can run. More variants are likely as the operators keep building.

Should you worry if you already use a hardware wallet?

The device itself isn't compromised. The attack lives entirely on the PC. A hardware wallet is still far safer than keeping crypto on an exchange or in a software-only wallet. What this campaign shows is that the weakest point was always the human at the keyboard, not the hardware. If a computer asks for your recovery phrase, the computer is lying.

Latest stories

Illustration: a dimly lit government building corridor at night in a Central Asian architectural
Threat Intelligence

Hackers tied to Kazakhstan used a WinRAR flaw to spy on CIS governments

Cisco Talos and Recorded Future say the group they call UAT-6275 ran a 14-month campaign against government, water and energy targets, and left its own tools exposed on the open internet.

Oct 15
Illustration: A dimly lit home office at night, a work laptop open on a desk showing a locked screen
Threat Intelligence

Hackers Are Going After Executives' Families to Get Past Corporate Security

Criminals are bypassing hardened corporate defences by targeting the people executives live with. Family members rarely have security training, and that gap is getting easier to exploit.

Oct 13
Illustration: A dark, empty corporate boardroom at night
Threat Intelligence

A Ransomware Negotiator Was Supposed to Be on Your Side. Now He's Charged With Extortion.

Edward Dubrovsky, a well-known incident-response executive, faces federal charges that may tie him to ShinyHunters, the group that broke into an FBI jobs site last month.

Oct 13
Illustration: an anonymous desk in a dim room: a stack of unmarked prepaid envelopes
Threat Intelligence

Ukrainian-Russian national pleads guilty to running 15,000-strong US money mule network

Oleg Korniev admitted leading Your Mule Cashout, a laundering ring that moved at least $10 million stolen from 750-plus US bank accounts over nearly two decades.

Oct 12
© 2026 Threat Vectr