Kaspersky Reveals OkoBot Malware Framework Targeting Cryptocurrency Investors

Cybersecurity company Kaspersky has disclosed that a new malware framework named OkoBot is targeting cryptocurrency investors through social engineering tactics and trojan-embedded GitHub applications. This malware can steal cryptocurrency wallet files, browser data, and user credentials, inject malicious extensions, and intercept wallet application windows to steal assets. Multiple attacks involving this malware family have been detected since January 2026. The OkoBot framework evolved from TookPS, which was first identified in 2025 and distributed trojan downloaders through fake software websites. Meanwhile, cybersecurity firm SlowMist has reported a wave of new malicious activities infiltrating Web3 developers' devices by impersonating LinkedIn job opportunities. Attackers pose as Web3 recruiters, sending fake GitHub repositories to lure developers into pulling code, installing dependencies, and running projects, ultimately stealing project keys, cloud credentials, or wallet extension data.

Disclaimer: This content is provided for general branding and informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online events, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets or to use any services. Crypto assets are highly volatile and may result in loss. WEEX services and online events may not be available in all regions and are subject to applicable laws, regulations, and eligibility requirements. You are responsible for ensuring that your use of WEEX services complies with local laws and for carefully assessing the risks before participating in any crypto-related activities.