OkoBot Framework: Detecting Seed Phrase Injection in Ledger and Trezor Wallets

---
title: OkoBot Suspicious Process Access to Wallet Applications
id: 8f2c4a10-1b3d-4c5e-9f6a-2b3c4d5e6f7a
status: experimental
description: Detects potential OkoBot activity where a non-system process grants suspicious access rights (VM Write/Operation) to Ledger or Trezor wallet processes.
references:
  - https://thehackernews.com/2026/07/okobot-malware-framework-injects-seed.html
author: Security Arsenal
date: 2026/07/14
tags:
  - attack.t1055
  - attack.process_injection
  - attack.credential_access
logsource:
  category: process_access
  product: windows
detection:
  selection:
    TargetImage|endswith:
      - '\Ledger Live.exe'
      - '\Trezor Suite.exe'
    GrantedAccess|contains:
      - '0x1FFFFF'
      - '0x143A'
      - '0x1010'
      - '0x1410'
    SourceImage|notcontains:
      - '\Program Files\'
      - '\Program Files (x86)\'
      - 'C:\Windows\System32\'
  condition: selection
falsepositives:
  - Legitimate antivirus scanners interacting with the process
level: high
---
title: OkoBot Suspicious Child Process Spawn from Wallet App
description: Detects unusual processes spawned directly by wallet applications, indicative of process hollowing or command execution via OkoBot.
id: 9e3d5b21-2c4e-5d6f-0a7b-3c4d5e6f7a8b
status: experimental
author: Security Arsenal
date: 2026/07/14
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\Ledger Live.exe'
      - '\Trezor Suite.exe'
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
  condition: selection
falsepositives:
  - Administrative troubleshooting (rare)
level: critical

// Hunt for OkoBot process injection indicators
// Look for non-system processes granting memory access rights to wallet apps
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("Ledger Live.exe", "Trezor Suite.exe")
| join kind=inner (
    DeviceProcessEvents
    | where ActionType == "ProcessCreated" // or specific ProcessAccess event if available in schema
    | project InitiatingProcessFileName, InitiatingProcessId, Timestamp
) on $left.ProcessId == $right.InitiatingProcessId
| where InitiatingProcessFileName !in~ ("Ledger Live.exe", "Trezor Suite.exe", "vlc.exe", "chrome.exe", "msmpeng.exe")
| project Timestamp, DeviceName, FileName, InitiatingProcessFileName, InitiatingProcessCommandLine, FolderPath

-- Hunt for handles opened against wallet applications
-- Commonly used by malware for UI injection or process hollowing
SELECT ProcessId, Pid, Name, Username, CommandLine
FROM pslist()
WHERE Name =~ 'Ledger Live.exe' OR Name =~ 'Trezor Suite.exe'

-- Then inspect handles for these PIDs in a secondary query or artifact
SELECT *
FROM handles(pid=ProcessId)
WHERE Name =~ 'Section'
   OR Name =~ 'Process'

# OkoBot Response & Verification Script
# Run as Administrator

Write-Host "[+] Verifying Integrity of Wallet Applications..."

$walletPaths = @(
    "$env:LOCALAPPDATA\Programs\Ledger Live\Ledger Live.exe",
    "$env:LOCALAPPDATA\Programs\Trezor Suite\Trezor Suite.exe"
)

foreach ($path in $walletPaths) {
    if (Test-Path $path) {
        $sig = Get-AuthenticodeSignature -FilePath $path
        if ($sig.Status -ne 'Valid') {
            Write-Host "[!] CRITICAL: Digital signature invalid or missing for $path" -ForegroundColor Red
            Write-Host "    Status: $($sig.Status) - SignerCertificate: $($sig.SignerCertificate.Subject)"
        } else {
            Write-Host "[+] Signature valid for: $path" -ForegroundColor Green
        }
    }
}

Write-Host "[+] Checking for suspicious persistence via Registry Run keys..."

$runKeys = @(
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run"
)

$suspiciousPatterns = @("powershell -enc", "iex", "Invoke-Expression")

foreach ($key in $runKeys) {
    if (Test-Path $key) {
        Get-Item $key | Select-Object -ExpandProperty Property | ForEach-Object {
            $propValue = (Get-ItemProperty -Path $key -Name $_).$_
            foreach ($pattern in $suspiciousPatterns) {
                if ($propValue -match $pattern) {
                    Write-Host "[!] WARNING: Suspicious value found in $key" -ForegroundColor Yellow
                    Write-Host "    Name: $_ | Value: $propValue"
                }
            }
        }
    }
}

Write-Host "[+] Verification complete. If errors were found, isolate the host and re-image."