Global cybersecurity firm Kaspersky has identified a malware framework called OkoBot that targets crypto users by stealing wallet seed phrases, credentials and other sensitive data through a collection of more than 20 malicious components.

The campaign, first identified in January 2026, has compromised hundreds of victims across more than 25 countries, with Brazil, Vietnam, Canada, Mexico and Türkiye among the most affected.

During the investigation, researchers found that attackers distribute the malware through ClickFix social engineering schemes and fake software downloads hosted on GitHub, allowing the framework to infect devices and deploy additional malware, including the Rilide browser stealer.

The framework consists of more than 20 payloads capable of stealing crypto wallets, harvesting credentials, recording video, downloading malicious browser extensions and executing remote commands.

Among OkoBot’s components are TookPS, which exfiltrates wallet seed phrases, OkoSpyware, which monitors Chromium-based browsers and records user activity, and SeedHunter, which injects malicious code into Trezor and Ledger wallet software to display phishing pages requesting recovery phrases.

Kaspersky said the campaign is still active and while its operators have not been identified, its techniques and code artifacts suggest links to Russian-speaking cybercriminals.

Mastercard and Visa ‘Absent’ from Russia as Cards Reach Expiration

As local options rise, the Russian card market is being increasingly driven by Mir alternatives after Mastercard and Visa, the two international credit giants, exited the country amid a sanctions push.

Dmitry Dubynin, CEO of the National Payment Card System (NSPK), stressed that international cards were absent from the Russian market, with local alternatives retaking almost all of the credit card market share.

“I would even say that Visa and Mastercard cards are effectively absent from the Russian market. Their cards no longer provide any value: they do not work abroad, there is no access to the loyalty programs of these payment systems, and so on,” said Dubynin in an interview with Expert magazine.

Dubynin compared these leftover cards to pieces of plastic bearing the logos of international companies that no longer operate in Russia, stressing that local support kept them operating.

He commented that eventually, these cards will fail as they endure wear and tear and their security certificates expire. Nonetheless, the NSPK is implementing measures to ensure its continued operation even under these circumstances.

“The share of cards issued by international payment systems continues to decline naturally. Today, nearly 85% of the market is accounted for by Mir cards, and that share will undoubtedly continue to grow,” Dubynin assessed.

Earlier statements by Alla Bakina, Director of the Bank of Russia’s National Payment System Department, who invited Visa and Mastercard to leave the country completely due to the lack of functionality of their cards, raised concerns among the population that still relied on these solutions.

Nonetheless, on July 2, central bank Governor Elvira Nabiullina disclosed that there would be no timeframes for their withdrawal, indicating that they would be phased out gradually.

U.S. prosecutors have accused a Florida man of uploading fake video games that contained malware to Steam, the popular PC games platform. Once victims downloaded and installed the games, the malware was designed to infect their computers, steal their passwords and other data, and drain their crypto wallets, according to a criminal complaint.

On Tuesday, the FBI arrested Zyaire Wilkins, a 21-year-old Florida resident and student. On Wednesday, prosecutors accused him and a number of unnamed co-conspirators of hacking crimes. Over the past two years, Wilkins and his partners allegedly published several malware-laden video games on Steam, including BlockBlasters, Dashverse, Lampy, Lunara, and PirateFi. Using that malware, says the FBI, Wilkins and his accomplices infected around 8,000 victims, and then hacked around 80 cryptocurrency wallets to steal at least $220,000 worth of crypto.

Wilkins and the others marketed their malicious video games on Discord, LinkedIn, and Telegram, according to the authorities.  

Wilkins’ lawyer did not respond to a request for comment. 

In March, the FBI announced that it was investigating a hacker suspected of using malware-embedded video games published on Steam to hack victims. In the announcement, the bureau called for people who downloaded the malicious games, which included those named in this week’s complaint, to come forward and provide evidence to aid the investigation. 

In the last year, Steam’s maker Valve has removed several video games from its platform after they were found to contain malware, including PirateFi. All the games were designed to look legitimate, to the point that players could install them and play them, but they all contained malware. 

After the FBI identified another person involved in the crimes, according to the complaint, federal agents interviewed them. The unnamed person said they worked with other people to raise money to launch and market the malicious games in return for sharing some of the stolen cryptocurrency. The FBI identified a specific crypto account involved in the scheme, and then traced cryptocurrency payments made with that account to buy several gift cards, including for Uber Eats. After subpoenaing Uber, the feds were able to see that the gift cards were linked to an account that made deliveries to Wilkins, who went by the nickname Sibel.eth online, according to the complaint. 

The feds then got a search warrant for Wilkins’ residence, where they seized his MacBook laptop, cellphones, other devices, and digital wallets. According to the complaint, he refused to speak or answer any questions.