In July 2026, Kaspersky's Global Research and Analysis Team published a breakdown of a malware framework it calls OkoBot. The framework has been active for over a year and has remained live at the time Kaspersky published. OkoBot is a toolkit of more than 20 payloads that infects a Windows machine, opens a hidden remote channel, and then deploys specialized plugins for specific jobs.
Kaspersky documented the malware's two main entry points: a "ClickFix" social-engineering attack, and malware hidden inside software downloaded from GitHub. One example was a fake SQL Server Management Studio package that was actually the real Audacity audio editor with a malicious library bolted on. It ranked at the top of search results, which made it look legitimate and earned user trust.
Once a user runs the bait, a PowerShell script called TookPS installs an SSH tunnel back to the attacker. An automated bot then harvests wallet files, browser cookies, and credentials, and quietly opens the door for the heavier payloads.
One of those payloads stood out to us. Kaspersky calls it SeedHunter, and it is built for a single purpose: stealing the recovery phrases of hardware wallet users. We read the report closely. Then we sat down with the two people responsible for Tangem's security to ask a direct question. Can SeedHunter work against Tangem?
What SeedHunter actually does
SeedHunter continuously watches the list of processes running on an infected Windows PC. It is looking for three specific applications: Trezor Suite, Ledger Live, and Ledger Wallet. When it finds one running, it injects its own code into that process.
These desktop wallet apps are built on Electron, a framework that wraps a web page inside a desktop application. SeedHunter hooks into the internal Electron functions, allowing it to rewrite what the app displays without the user noticing. The wallet's own window becomes the attacker's canvas.
The malware runs periodic USB scans, filtered by Vendor ID and Product ID, and waits for a genuine Trezor or Ledger device to be plugged in. Kaspersky found that the malware can either wait for a "go" signal from its command server or fire immediately, depending on a flag it receives.
When a device connects, the malware displays a hard-coded phishing page inside the trusted app, with a different layout tailored to each wallet brand. The page asks the user to enter their seed phrase to "recover" or "verify" the wallet.
The user believes they are typing into their own genuine wallet software, prompted by their own device being plugged in. When the phrase is entered, the malware captures it, sends it to a command server, and also saves an encrypted local copy. The funds are then drained at the attacker's leisure.
OkoBot's other plugins significantly broaden the net. OkoSpyware compiles a list of over 100 target applications, including wallets like Exodus and password managers like 1Password and KeePassXC, then records video of their windows using a bundled copy of FFmpeg while logging every keystroke.
The picture Kaspersky paints is one of total surveillance of the infected machine, with a purpose-built seed-phrase trap at its center.
When the attacker has nothing to steal
SeedHunter needs four separate conditions to succeed. Against a default Tangem setup, all four are absent.
It needs a seed phrase to phish. This is the foundation of the entire attack. In the standard Tangem model, the private key is generated inside the card's certified secure element and never leaves it. If the user does not have a seed phrase, there is nothing for a phishing page to ask for.
Second, it needs a desktop app to inject into. SeedHunter targets three specific Windows processes, all of them Electron desktop apps. Tangem has no desktop application.
Third, it needs a USB device to detect. The malware's trigger is a USB scan for the Vendor and Product IDs of known wallet hardware. Tangem cards communicate with a phone over NFC by tapping.
Fourth, it needs a believable pretext. Ledger and Trezor users know that recovery and verification flows are built into their apps, so a prompt asking for the phrase feels routine. Tangem's standard flow never asks the user to type a recovery phrase. You scan your card/ring and enter your biometrics or access code. A prompt asking for a seed phrase would be a red flag to a Tangem user.
Andrey Lazutkin, Tangem's CTO, sees the seed phrase itself as the structural weakness that these attacks target.
"When people buy a hardware wallet, they expect the device to protect their private keys. But in many traditional wallets, the device first displays the seed phrase to the user and hands responsibility back to them."
"From that moment on, the weakest link is no longer the hardware wallet," he continued. "It is the seed phrase: a piece of paper, a metal plate, a drawer, a safe, a photo someone should never take, or a phrase that can be lost, damaged, copied, exposed, or stolen."
Phishing attacks also continue targeting seed phrases directly, because once a seed phrase is exposed, the price or security level of the hardware wallet no longer matters.
What defends the smartphone?
Tangem's mobile-first, hardware-anchored model sidesteps OkoBot structurally. However, mobile malware is a real category. So we asked how the app itself resists the three core techniques OkoBot relies on: fake overlays, keylogging, and screen capture.
According to Lazutkin, the Tangem app runs a full stack of runtime protections.
runtime integrity checks,
anti-debugging,
anti-emulation,
root and jailbreak detection,
encrypted storage,
secure communication,
certificate validation,
WebView protection,
tapjacking protection,
secure input handling.
He also added minimized permissions, code review, audits, and automated security checks on top of that. Three of those defenses map directly onto OkoBot's own methods (Tapjacking, keylogging, video capture).
Tapjacking protection is the mobile answer to SeedHunter's fake screen. On mobile, the equivalent of overwriting an app's window is to float an invisible or misleading overlay on top of it, so the user thinks they are tapping one thing while actually authorizing another. The Tangem app actively checks for obscured views during user interaction to ensure that no invisible UI overlays can hijack user taps in sensitive parts of the app. An overlay attack is always detected and blocked.
Secure input handling is the answer to the keylogger. Custom keyboards are a common vector for capturing what users type, so the app detects their use when users enter sensitive data. It also disables autocomplete, spell-check, password saving, and predictive text on critical fields, because those conveniences can quietly cache or suggest sensitive input and leak it later.
Blocked screenshots and screen recording answer OkoSpyware's video capture. In any part of the app that displays sensitive data, screenshots and screen recording are prohibited outright. The technique OkoSpyware uses to film wallet windows on a PC is denied at the operating-system level on the phone.
OkoBot spread through a fake GitHub repository that was indexed by search engines and ranked at the top of results for a common software query. Users searching for a legitimate tool found the malicious one first.
It also used a trojanized dependency. Kaspersky traced the final payload to a malicious protobuf.dll bundled with an open-source utility, which appeared identical to the legitimate library but, upon decryption, launched the real plugin dispatcher underneath.
When a legitimate-looking program loaded the library, it also loaded the malware. This is the same category of attack that has burned major software projects: poison a trusted dependency, and everything downstream inherits the poison.
We asked Anton Afanasyev, Tangem's CISO, how Tangem protects its build pipeline against exactly this.
"We use a combination of measures," he said. The first is reducing dependence on outside code for the parts that matter most. "We forked or rewrote some of the required external libraries, specifically the most critical ones." A forked and internally maintained library cannot be silently swapped for a trojanized version the way a blindly-pulled public dependency can.
The second layer is process discipline. "We have a secure development process in place, including vulnerability checks on all dependencies, a controlled update window, code review, and so on." A controlled update window matters here: dependencies are not pulled in automatically when a new version drops, which is precisely when a compromised package can do its damage. Updates are reviewed and admitted deliberately.
We also asked Lazutkin about the possibility of a malicious update pushed not through a dependency, but through the official app store, using stolen developer credentials.
For that attack to succeed, he said, "an attacker would need to compromise our developer credentials, bypass MFA and internal access controls, get through the release approval process, inject malicious code into the official build, pass Apple or Google review, preserve the official app identity, avoid platform malware detection, and remain unnoticed by our team, monitoring systems, and the open-source community."
Threat monitoring campaign
OkoBot ranked a fake repository in search results and imitated trusted brands to earn user trust. Defending against this distribution strategy requires constant monitoring. We asked Afanasyev how Tangem detects fake apps, fake repositories, and phishing pages that mimic our branding.
"Tangem monitors security threat intelligence and news channels for malware families and campaigns relevant to its users, and I own this watch directly." On the counterfeit and impersonation side, he said, "We track these by monitoring various resources and unofficial Android app stores, including GitHub."
Phishing takedowns run on two inputs working together. "Our users report phishing sites and fake social media and messenger accounts to us," Afanasyev said. The second input is classified. When a phishing resource is identified, Tangem coordinates with some responsible parties to handle the takedown.
We saved the sharpest question for last. Has any known stealer or spyware family added the Tangem app to its watchlist, as OkoSpyware does with MetaMask and Tonkeeper?
"So far, we are not aware of any such mobile malware," Afanasyev said. He was precise about the one thing that does exist. On desktop, attackers have run campaigns telling users to download a fake "Tangem Desktop" application. "These are simple, conventional viruses that just open remote access to the victim's computer." It is not a targeted seed-phrase stealer like SeedHunter. The attackers fall back to generic remote-access malware because the specialized attack has no target.
The takeaway
SeedHunter is a well-engineered attack against a specific design: a desktop wallet application connected to a physical device via USB that, at some point, displays a seed phrase to the user.
Tangem is not designed with any of those three points. So the framework's most sophisticated plugin arrives at a Tangem user's door and finds nothing to do. It scans for USB wallets that are not there. It waits to inject into desktop processes that do not exist. It stands ready to phish a phrase that was never written down.
This outcome is the direct, predictable result of a security philosophy that removes components instead of adding them, and that keeps the one thing that matters, the private key, sealed inside a chip that never has to trust the computer it talks to.
There are still real user responsibilities. A user who imports an external seed phrase into Tangem and keeps a paper copy of it has reintroduced the exact weak link that SeedHunter hunts for, and can still be phished for that phrase through other channels.
