Kaspersky security researchers have identified a new malware, OkoBot, which targets cryptocurrency wallets by stealing seed phrases and credentials. The malware operates through approximately 20 modules, including SeedHunter, MC Keylogger, and OkoSpyware, to infiltrate hardware wallets like Trezor and Ledger, record keyboard activity, and track wallet passwords. OkoBot is distributed via GitHub repositories disguised as legitimate tools, using ClickFix social engineering techniques to deceive users. Active for over a year, OkoBot has primarily affected users in Brazil, Vietnam, Canada, Mexico, and Turkey, while implementing geo-blocking against Russian and CIS IP addresses. Once attackers obtain a seed phrase, they can fully control the victim's crypto assets, making recovery nearly impossible.