OkoBot: new sophisticated malware framework targets cryptocurrency users

Key Takeaways

• Introduction In January 2026, we identified multiple attacks involving unknown malware that captures the contents of cryptocurrency wallet windows.
• However, this campaign differs from previous activity in that it uses a new framework to deliver all malicious modules and orchestrate them via an SSH.