Kaspersky has uncovered a new malware framework, dubbed OkoBot, that specifically targets cryptocurrency users and related developers. The company says the campaign begins with social engineering and compromised developer tools — including a ClickFix-style trick that convinces victims to run malicious commands and trojanized GitHub applications that install a backdoor on machines.
Once active, OkoBot can harvest crypto wallet files, browser-stored data and user credentials, inject malicious browser extensions, and capture wallet application windows to exfiltrate assets. Kaspersky reports multiple attacks using this family since January 2026. The framework evolved from a 2025 campaign known as TookPS, which used fake software sites to distribute a Trojan downloader. Unlike earlier campaigns, OkoBot orchestrates some 20 malicious payloads over an SSH tunnel, allowing remote transport of data from infected hosts to attacker-controlled infrastructure.
Separately, blockchain security firm SlowMist describes a related scheme that targets Web3 developers through fake LinkedIn recruitment approaches. In these incidents attackers pose as recruiters, send spoofed GitHub repositories labeled as a minimum viable product to review before an interview, and rely on the normal technical-interview workflow (pulling code, installing dependencies, and running projects) to trick developers into executing malicious code.
The implanted payload in these recruitment-style attacks is a remote access trojan (RAT) that enables attackers to steal project keys, cloud credentials, and wallet-extension data from compromised developer machines. SlowMist warns this is not an isolated tactic and that threat actors increasingly exploit scenarios such as recruitment, code reviews, and collaboration requests to coax developers into running poisoned repositories.
SlowMist also recently alerted to a macOS campaign aimed at stealing credentials and hijacking Telegram sessions. That campaign attempts to lure investors into entering wallet recovery phrases on fraudulent websites after taking control of messaging sessions.
Recommendations
– Treat unexpected recruitment messages and unsolicited GitHub links with caution. Verify recruiters’ identities and use separate, sandboxed environments or virtual machines for evaluating untrusted code.
– Avoid running commands or installers you don’t fully understand; inspect repositories and dependency trees before executing.
– Use hardware wallets or well-audited, up-to-date wallet software and browser extensions; protect seed phrases offline.
– Monitor for unusual SSH tunnels, outbound connections, or new browser extensions and revoke exposed credentials immediately.
This reporting highlights attackers’ growing focus on social-engineering supply chains and developer workflows to reach cryptocurrency assets. Verify sources and remain cautious when collaborating or evaluating code from unknown parties.
