Signalis
sign in--:--:--UTC
Threat actors

OkoBot operators

☆ pin
Reports
3
First seen
Jul 15, 2026
Last seen
Jul 16, 2026
Motivation
Financial

Targeting

Sectors
Other ×1Technology ×1

Top ATT&CK techniques

T1566 Phishing ×3T1059.001 PowerShell ×3T1562.001 Impair Defenses: Disable or Modify Tools ×3T1195 Supply Chain Compromise ×3T1555 Credentials from Password Stores ×2T1056.004 Phishing for Information ×2T1113 Screen Capture ×1T1053 Scheduled Task/Job ×1T1047 Windows Management Instrumentation ×1T1041 Exfiltration Over C2 Channel ×1T1547.009 Boot or Logon Autostart Execution: Services ×1T1055 Process Injection ×1

Indicators

filename ×19hash_md5 ×15domain ×7ip_v4 ×3

Indicator values are available on Pro and via the API.

Recent reports

High

OkoBot malware framework delivers 20 payloads targeting cryptocurrency wallets and credentials

Bleeping ComputerHigh

OkoBot Malware Framework Injects Seed Phrase Phishing Into Ledger and Trezor Apps

The Hacker NewsHigh

OkoBot: Sophisticated Multi-Stage Malware Framework Targets Cryptocurrency Users

Kaspersky Securelist

This page shows data on a 7-day delay. Free accounts get the full delayed feed; real-time reports, indicators, and the API start at $29/mo.

Sign upSee plans