Signal
Kaspersky uncovers OkoBot malware targeting crypto investors via fake GitHub apps
Evidence first: scan the strongest sources, then decide whether to go deeper.
Published 2026-07-18 11:40 UTCUpdated 2026-07-18 19:30 UTC
rsstelegram
cryptomalwaresecurityinvestorswallets
Trend in the last 24h
Source links open
Source links and full evidence are open here. Archive history, compare-over-time, alerts, exports, API, integrations, and workflow are paid.
No card needed for the free brief.
Evidence trail (top sources)
top sources (2 domains)domains are deduped. counts indicate coverage, not truth.2 top sources shown
limited source diversity in top sources
Overview
Kaspersky's recent discovery highlights a complex malware campaign named OkoBot that has been active for more than a year. This malware uses social engineering and trojanized applications on GitHub to steal recovery phrases from crypto wallets, affecting users across multiple countries. The multi-module design of OkoBot underscores the evolving sophistication of cyber threats targeting cryptocurrency investors, emphasizing the critical need for vigilance in protecting wallet credentials.
Entities
KasperskyOkoBot
Score total
1.27
Momentum 24h
3
Posts
3
Origins
2
Source types
2
Duplicate ratio
33%
Why now
- Kaspersky's recent discovery reveals an active malware campaign ongoing for over a year.
- The malware's multi-module design shows evolving complexity in crypto-targeted cyberattacks.
- Growing crypto adoption increases the potential impact of such targeted malware attacks.
Why it matters
- Highlights ongoing cybersecurity threats to crypto investors from sophisticated malware.
- Demonstrates risks of trojanized apps on popular developer platforms like GitHub.
- Emphasizes the importance of protecting crypto wallet recovery phrases from theft.
LLM analysis
Topic mix: lowPromo risk: lowSource quality: high
Recurring claims
- OkoBot malware targets crypto investors by stealing wallet recovery phrases via fake GitHub apps and social engineering.
How sources frame it
- Kaspersky Cybersecurity Researchers: neutral
This report underscores the persistent and evolving cyber threats facing crypto investors, particularly through trusted developer platforms like GitHub.
All evidence
All evidence
Kaspersky exposes OkoBot’s 20-module crypto wallet attack
Crypto.News · crypto.news · 2026-07-18 12:18 UTC
Kaspersky identifies malware framework targeting crypto investors
Cointelegraph · cointelegraph.com · 2026-07-18 11:40 UTC
Show filters & breakdown
Posts loaded: 0Publishers: 2Origin domains: 2Duplicates: -
Showing 2 / 0
Top publishers (this list)
- Crypto.News (1)
- Cointelegraph (1)
Top origin domains (this list)
- crypto.news (1)
- cointelegraph.com (1)