OkoBot injects fake Ledger and Trezor windows to steal seed phrases
Kaspersky’s GReAT team reports that the OkoBot framework, active since April 2025, uses a SeedHunter module to watch for Ledger Live and Trezor Suite on Windows PCs. It injects a fake recovery‑phrase window inside the genuine app, captures the seed phrase and forwards it to a moonsand.store C2, putting crypto holders worldwide at risk.