OkoBot malware injects fake seed-phrase prompts into real Ledger and Trezor apps

Kaspersky detailed OkoBot, a Windows malware framework active since 2025 whose standout module, SeedHunter, tricks hardware-wallet owners into giving up their recovery phrase. On an infected PC, the malware waits for wallet software like Ledger Live, Ledger Wallet, or Trezor Suite, sometimes until the device is plugged in, then displays a malicious page asking for the seed phrase from inside the wallet's own genuine app. Because the surrounding application is the real one the victim installed, the request looks legitimate, but anyone who types in the phrase hands over full control of their funds. Kaspersky counted hundreds of victims across more than 25 countries, and the framework remains active.

Check

Remind cryptocurrency users that hardware wallets never ask for the recovery phrase to be typed into a computer, and any prompt requesting it, even inside the real wallet app, is a scam.

Affected

Hardware-wallet owners on OkoBot-infected Windows PCs; the malware injects a fake recovery-phrase request into the genuine Ledger or Trezor desktop app, and victims who enter the phrase lose control of their cryptocurrency.

Fix

Never enter a wallet recovery phrase into any computer prompt, keep endpoints protected to catch OkoBot, and confirm sensitive actions on the hardware device's own screen rather than the desktop app.