Key Takeaways
- • Kaspersky's Global Research & Analysis Team (GReAT) identified over 200 malicious GitHub repositories hosting a sophisticated malware framework targeting cryptocurrency investors, with hundreds of victims confirmed across 25+ countries.
- • The campaign employs a multi-component malware framework called Okobot, comprising more than 20 malicious payloads designed to steal cryptocurrency wallet seed phrases, credentials, and execute remote commands through modules including TookPS and OkoSpyware.
- • OkoSpyware, a newly identified module, captures keystrokes and video streams of target applications, including wallet interfaces, while also intercepting functions of major hardware wallet applications (Ledger Live, Ledger Wallet, Trezor Suite) to display fake authentication screens.
- • Brazil, Vietnam, Canada, Mexico, and Türkiye recorded the highest concentrations of affected users; the threat remains active with no definitive attribution to known crimeware actors, though technical analysis reveals code artifacts consistent with Russian-speaking threat actors.
- • Fraudulent projects use AI-generated instructions and fake activity logs to appear legitimate, distributing stealers, clippers, and backdoors through open-source repositories—a supply chain attack vector exploiting developer trust in GitHub's ecosystem.
Summary
Kaspersky's Global Research & Analysis Team disclosed in January 2026 a large-scale malware campaign leveraging over 200 fake GitHub repositories to distribute sophisticated credential and cryptocurrency theft tools targeting developers and crypto investors. The campaign centers on a previously unknown malware framework dubbed Okobot, comprising more than 20 distinct malicious payloads and implants engineered to perform a wide range of destructive functions including wallet compromise, seed phrase extraction, credential harvesting, keystroke logging, video capture, and arbitrary command execution.
The technical architecture of Okobot reflects significant sophistication. The framework includes TookPS, a module designed specifically to exfiltrate seed phrases from compromised systems, and OkoSpyware, a newly identified spyware component that monitors Chromium-based browsers, captures keystroke activity, and records video streams of target application windows. Notably, the malware includes a specialized loader that modifies browser memory to covertly install and conceal malicious extensions, enabling persistent unauthorized access to wallet interfaces and banking systems. The framework also targets hardware wallet applications directly, including Ledger Live, Ledger Wallet, and Trezor Suite, by deploying fake authentication screens that intercept user credentials during legitimate wallet operations.
The campaign's operational footprint spans over 25 countries, with documented victim concentrations in Brazil, Vietnam, Canada, Mexico, and Türkiye. Kaspersky researchers confirmed hundreds of victims across this geographic distribution, though the active campaign continues to pose ongoing risk to cryptocurrency users. The attack vector leverages social engineering and trust exploitation—fraudulent GitHub projects are disguised as legitimate open-source tools using AI-generated documentation and fabricated activity logs, lowering user suspicion when downloading seemingly authentic developer resources.
Attribution remains uncertain based on current intelligence. However, Kaspersky analysts identified technical indicators consistent with Russian-speaking threat actors, including code artifacts and operational methodologies widely employed within that community. The campaign represents a significant supply chain security vulnerability, exploiting the inherent trust developers place in open-source repositories and GitHub's ecosystem, effectively weaponizing the collaborative development platform as a distribution channel for infostealer malware targeting high-value targets in the cryptocurrency sector.
The technical architecture of Okobot reflects significant sophistication. The framework includes TookPS, a module designed specifically to exfiltrate seed phrases from compromised systems, and OkoSpyware, a newly identified spyware component that monitors Chromium-based browsers, captures keystroke activity, and records video streams of target application windows. Notably, the malware includes a specialized loader that modifies browser memory to covertly install and conceal malicious extensions, enabling persistent unauthorized access to wallet interfaces and banking systems. The framework also targets hardware wallet applications directly, including Ledger Live, Ledger Wallet, and Trezor Suite, by deploying fake authentication screens that intercept user credentials during legitimate wallet operations.
The campaign's operational footprint spans over 25 countries, with documented victim concentrations in Brazil, Vietnam, Canada, Mexico, and Türkiye. Kaspersky researchers confirmed hundreds of victims across this geographic distribution, though the active campaign continues to pose ongoing risk to cryptocurrency users. The attack vector leverages social engineering and trust exploitation—fraudulent GitHub projects are disguised as legitimate open-source tools using AI-generated documentation and fabricated activity logs, lowering user suspicion when downloading seemingly authentic developer resources.
Attribution remains uncertain based on current intelligence. However, Kaspersky analysts identified technical indicators consistent with Russian-speaking threat actors, including code artifacts and operational methodologies widely employed within that community. The campaign represents a significant supply chain security vulnerability, exploiting the inherent trust developers place in open-source repositories and GitHub's ecosystem, effectively weaponizing the collaborative development platform as a distribution channel for infostealer malware targeting high-value targets in the cryptocurrency sector.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.