Crypto wallet malware attacks

In late July 2026 security researchers reported a rise in sophisticated malware aimed at stealing cryptocurrency assets. The first report described the OkoBot framework, which harvests saved passwords, session cookies and device fingerprints to bypass multi‑factor authentication and directly compromise hardware wallets such as Ledger and Trezor. Its SeedHunter component injects malicious code that prompts users for recovery phrases, enabling attackers to transfer funds from compromised wallets.

Two days later, a new mobile threat called SparkKitty was identified. Distributed through seemingly legitimate apps on both the Apple App Store and Google Play, the malware gains access to the device’s photo gallery and uses optical character recognition to locate seed phrases stored in screenshots or photos. When a phrase is found, it is exfiltrated to command‑and‑control servers, allowing the theft of the associated crypto wallets. The campaign underscores the risk of keeping recovery words in digital form and highlights a shift toward leveraging app‑store distribution and image‑scanning techniques.

Together, the snapshots illustrate an expanding cyber‑crime ecosystem in which attackers combine credential‑stuffing, MFA bypass, and novel seed‑phrase harvesting methods to target cryptocurrency users worldwide.