THREAT OPS › Threat News › OkoBot: new sophisticated malware framework targets cryptocurrency users
OkoBot: new sophisticated malware framework targets cryptocurrency users
<p><img alt="" class="attachment-securelist-huge-promo size-securelist-huge-promo wp-post-image" height="400" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2026/07/14091633/okobot-featured-image-990x400.jpg" width="990" /></p><h2 id="introduction">Introduction</h2> <p>In January 2026, we identified multiple attacks involving unknown malware that captures the contents of cr
MITRE ATT&CK techniques
Indicators of compromise
- b07d451ee65a1580f20a784c8f0e7a46md5
- 187a1f68ae786e53d3831166dc84e6d2md5
- d84e8dc509308523e0209d3cd3544619md5
- 83e6b8fcb92a0b13e109301f8ff649cfmd5
- 7306885bb4c98f2a9f056104cf092bc9md5
- b4c2e16cdb513be4dc798f88e2527334md5
- 2157d2429124ad28db7a26f2477cb985md5
- 77cecf5e2a622ae07d8ae9913457ab57md5
- e0c3bc27a65750e740c4f1719e531c7dmd5
- 3d2b43f91f65bfbf36a9c71b6b418876md5
- 70fef9fd6e351f4d53cfeee8dcdfcd99md5
- acd31c9941b6c1cabd4e45e6877b9038md5
- dd52f5108a176c62ad807c327734ad12md5
- ac93a821617aea1f56d4bc0bef4af327md5
- 11dbc8a2bea04b15f8f68f3f01e8faf9md5
- https://googleprojectzero.blogspot.com/2019/12/calling-local-windows-rpc-servers-from.htmlurl
- https://www.kaspersky.com/enterprise-security/threat-intelligence-reporting?icid=gl_sl_post-link-tip-reports_sm-team_54d4bf9ad05581e5url
- https://opentip.kaspersky.com/b07d451ee65a1580f20a784c8f0e7a46/results?icid=gl_sl_post-opentip_sm-team_595640c4401f4635&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/187a1f68ae786e53d3831166dc84e6d2/results?icid=gl_sl_post-opentip_sm-team_56375695210dc82c&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/d84e8dc509308523e0209d3cd3544619/results?icid=gl_sl_post-opentip_sm-team_cb1ba87ebbf3a4b8&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/83e6b8fcb92a0b13e109301f8ff649cf/results?icid=gl_sl_post-opentip_sm-team_6834f0a80bf8a670&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/7306885bb4c98f2a9f056104cf092bc9/results?icid=gl_sl_post-opentip_sm-team_5fd44b63f2d4fbad&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/b4c2e16cdb513be4dc798f88e2527334/results?icid=gl_sl_post-opentip_sm-team_3b3c1a4b16642322&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/2157d2429124ad28db7a26f2477cb985/results?icid=gl_sl_post-opentip_sm-team_337093a300824b14&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/77cecf5e2a622ae07d8ae9913457ab57/results?icid=gl_sl_post-opentip_sm-team_55c16529a547c360&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/e0c3bc27a65750e740c4f1719e531c7d/results?icid=gl_sl_post-opentip_sm-team_3d8d3f0ca4998f2d&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/3d2b43f91f65bfbf36a9c71b6b418876/results?icid=gl_sl_post-opentip_sm-team_0a7258db5c116739&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/70fef9fd6e351f4d53cfeee8dcdfcd99/results?icid=gl_sl_post-opentip_sm-team_f43ebfac51c33123&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/acd31c9941b6c1cabd4e45e6877b9038/results?icid=gl_sl_post-opentip_sm-team_b9ae4011be0bb291&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/dd52f5108a176c62ad807c327734ad12/results?icid=gl_sl_post-opentip_sm-team_ce70040326b205a7&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/ac93a821617aea1f56d4bc0bef4af327/results?icid=gl_sl_post-opentip_sm-team_1b5651cc13c7e3ca&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/11dbc8a2bea04b15f8f68f3f01e8faf9/results?icid=gl_sl_post-opentip_sm-team_7b407253f41a33f2&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/2baserec2.guru/?icid=gl_sl_post-opentip_sm-team_29c3228cd3d46daf&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/recavb22.online/?icid=gl_sl_post-opentip_sm-team_a8df0286427021e7&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/kbeautyreviews.com/?icid=gl_sl_post-opentip_sm-team_77fa3774b6495fc3&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/coffeesaloon.online/?icid=gl_sl_post-opentip_sm-team_4e2d23ef08c3bf63&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/104.243.43.16/?icid=gl_sl_post-opentip_sm-team_9f57ffd1179ea865&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/104.243.32.213/?icid=gl_sl_post-opentip_sm-team_e392f054a25a04c4&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/62.210.188.209/?icid=gl_sl_post-opentip_sm-team_ab59221a1143866f&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/livewallpapers.online/?icid=gl_sl_post-opentip_sm-team_3b0c5423ae7d3e9b&utm_source=SL&utm_medium=SL&utm_campaign=SLurl