OkoBot Malware Uses ClickFix, Hidden Browser Extensions to Steal Crypto Data

Kaspersky reports that OkoBot malware targets crypto users through fake software and hidden browser extensions to steal seed phrases, wallet files, and passwords. Simultaneously, researchers from Elastic Security Labs identified TELEPUZ, a lightweight modular malware spreading via ClickFix lures since April 2026. While OkoBot focuses on recording wallet app activity and stealing crypto data, TELEPUZ is designed to steal general data and execute remote commands through a small number of C2 domains.