OkoBot Malware Targets Ledger and Trezor Users

OkoBot malware has been running on Windows since April 2025, using a module called SeedHunter to inject phishing pages into legitimate Trezor Suite, Ledger Wallet, and Ledger Live apps. The malware waits for a hardware wallet to be plugged in before displaying a fake recovery phrase page. Kaspersky's GReAT team identified hundreds of victims across 25 countries, with the largest numbers in Brazil, Vietnam, Canada, Mexico, and Türkiye.