SeedHunter

SeedHunter is a Windows malware component within the OkoBot framework that targets cryptocurrency users by stealing recovery seed phrases from Ledger and Trezor wallet users. Rather than attacking hardware wallets directly, it compromises the endpoint and abuses trust in legitimate companion wallet applications. SeedHunter monitors infected systems for Trezor Suite, Ledger Wallet, and Ledger Live, injects into those processes, and hooks Electron application internals to present fraudulent recovery interfaces inside the legitimate software environment. It can optionally wait until a real Ledger or Trezor device is connected before triggering the phishing workflow, increasing plausibility and likely improving theft success.

The malware captures entered seed phrases from the compromised application context and exfiltrates them to attacker-controlled infrastructure. It also stores a locally encrypted copy of stolen data. SeedHunter is associated with broader OkoBot intrusions that used ClickFix lures and trojanized software as initial access vectors, followed by a PowerShell-based downloader, SSH-backed remote access, and staged deployment of additional implants. In observed operations, SeedHunter was delivered alongside other OkoBot modules including spyware, keylogging, browser theft, and process-injection components, indicating use in multi-stage financially motivated campaigns centered on cryptocurrency theft.

Victimology associated with OkoBot-linked SeedHunter activity spans more than 25 countries, with notable concentrations in Brazil, Vietnam, Canada, Mexico, and Türkiye. Public reporting has not definitively attributed the campaign to a known threat actor, though some tradecraft and development artifacts have been assessed as consistent with overlap in Russian-speaking cybercriminal ecosystems.