Trusted software platforms are increasingly being abused to distribute malware. A newly identified malware framework called OkoBot combines ClickFix attacks, fake GitHub repositories, and a staged infection chain to compromise Windows systems and steal sensitive data.<\/p>\n
According to Kaspersky, OkoBot evolved from the previously documented TookPS campaign and uses a modular architecture to deploy more than 20 malicious payloads<\/a>. Observed modules harvest browser credentials, cookies, password manager data, cryptocurrency wallet seed phrases, and other sensitive information. Researchers also identified components that install hidden Chromium-based browser extensions and capture keystrokes.<\/p>\n For organizations, the campaign highlights how trusted developer platforms and social engineering can increase the risk of credential theft and endpoint compromise, reinforcing the need for stronger software trust and endpoint security controls<\/a>.<\/p>\n