Kaspersky identifies malware framework targeting crypto investors

Kaspersky identified a new malware framework called OkoBot targeting cryptocurrency investors. The malware uses social engineering tactics like ClickFix and trojanized GitHub apps to deliver a backdoor. It harvests crypto wallet files, browser data, and credentials, and orchestrates 20 malicious payloads via an SSH tunnel. The framework evolved from the TookPS campaign.