Two separate cybersecurity reports point to a growing trend in crypto-related malware: attackers are no longer relying only on obvious phishing emails. Instead, they are moving closer to the workflows people already use—recruiting pipelines, developer code trials, and wallet-related software behavior.

Kaspersky says it has uncovered a cryptocurrency-targeting malware framework dubbed “OkoBot,” which initiates an infection chain through social engineering, malicious commands, and trojanized GitHub applications. Separately, SlowMist describes a campaign aimed at Web3 developers that starts with fake LinkedIn recruitment offers and ends with poisoned repositories designed to deliver remote access.

Key takeaways

• Kaspersky links the OkoBot framework to wallet theft activity, including harvesting wallet files and capturing browser and credential data.
• OkoBot is designed to steal assets by injecting malicious browser extensions and collecting wallet application windows, Kaspersky reports.
• SlowMist warns that fake “recruitment” messages are being used to trick developers into running malicious GitHub repositories that resemble legitimate interview tasks.
• SlowMist says the campaign’s goal is to deliver a remote access trojan that can exfiltrate project keys and cloud or wallet extension data.
• Both reports emphasize social engineering paths—ClickFix-like tactics or developer-targeted collaboration scenarios—that make the attacks harder to spot.

Kaspersky: OkoBot targets crypto investors through wallet and credential theft

In a report released this week, Kaspersky describes OkoBot as a malware framework built to compromise cryptocurrency investors by chaining together multiple stages of intrusion. The first step is not purely technical; it relies on social engineering methods intended to get victims to act.

According to Kaspersky, initial access can come from tactics such as ClickFix, a technique that aims to trick users into running malicious commands. Alternatively, attackers may deliver similar outcomes by distributing trojanized GitHub apps that include backdoors once installed.

After gaining a foothold, Kaspersky says OkoBot has capabilities specifically relevant to crypto users and their systems. The malware can harvest crypto wallet files, collect browser data and user credentials, and manipulate the victim’s environment by injecting malicious extensions. It also reportedly captures wallet application windows, which can give attackers a more direct path to stolen assets than credential theft alone.

Kaspersky added that it has observed multiple attacks involving the OkoBot malware family since January 2026, suggesting the framework is not a one-off operation but part of an active campaign.

Evolution from TookPS: more orchestration, more reach

Kaspersky also frames OkoBot as an evolution of a prior threat. The company says the malware framework evolved from “TookPS,” a campaign first identified in 2025 that distributed a Trojan downloader via fake software websites. That earlier stage matters because it signals a progression in how attackers deliver and manage malicious payloads: from initial trickery and download into a more structured compromise process.

A distinctive operational detail in Kaspersky’s account is how OkoBot manages its payloads. The report states that it orchestrates all 20 malicious payloads via an SSH tunnel, allowing remote transport of data from infected computers to infrastructure controlled by attackers.

For investors and defenders, this design choice matters because it can complicate incident response. Data exfiltration over an SSH tunnel may blend with normal encrypted traffic patterns, and the multi-payload architecture suggests victims may not see a single obvious “binary” responsible for damage.

SlowMist: fake LinkedIn recruiting and “try before interview” repositories

In a separate report, SlowMist describes another approach to malware delivery: it targets Web3 developers by disguising an attack as recruitment. Rather than sending victims a generic phishing link, attackers reportedly contact developers through LinkedIn while posing as Web3 recruiters.

SlowMist says the attackers follow up with instructions to download and run code from fake GitHub repositories. The bait is framed as a realistic recruitment process: the repository is presented as a “minimum viable product” that the developer should try before the interview, which aligns closely with how technical screenings often work.

The company notes that the workflow looks and feels like a genuine interview assignment: developers are expected to pull code, install dependencies, and launch the project. That resemblance is a key factor in why the attack can be difficult to detect—there may be no obvious sign that a “try it now” task is actually weaponized.

Remote access trojan goals: keys, credentials, and extension data

According to SlowMist, the end goal of the LinkedIn-and-GitHub tactic is to deliver a complete remote access trojan onto the victim’s device. Once installed, SlowMist says attackers can steal sensitive information relevant to Web3 work, including project keys, cloud credentials, or wallet extension data.

SlowMist also emphasizes that this is not an isolated tactic. The report argues that attackers are increasingly exploiting scenarios that encourage developers to run code—such as recruitment tasks, code reviews, and project collaborations—turning normal professional behavior into an infection vector.

It is also notable that SlowMist’s write-up arrives amid a broader pattern of recent warnings. The security firm had also previously cautioned about a separate malware campaign targeting macOS users, designed to steal credentials, hijack Telegram sessions, and ultimately pressure victims into entering wallet recovery phrases via fake websites.

For readers and builders, the common thread across both reports is the same: attackers are calibrating their intrusions to the moments when people are most likely to click “run,” install, or test code—whether that happens after a recruiter message on LinkedIn or after a malicious “app” appears to be a legitimate GitHub tool. The next thing to watch is whether these campaigns expand into more standardized tooling for developers and more automation for account-level compromise, since both Kaspersky and SlowMist describe activity that looks organized and iterative rather than sporadic.

Kaspersky has exposed OkoBot, a year-old malware operation that uses roughly 20 modules to steal crypto wallet recovery phrases and has affected users across at least five countries.

Kaspersky researchers discovered that the malware has remained active for more than a year, according to a report published by Bits.media. Most identified victims were located in Brazil, Vietnam, Canada, Mexico, and Turkey, while the operators blocked IP addresses from Russia and other Commonwealth of Independent States countries.

Distributed through GitHub repositories, OkoBot is disguised as legitimate software, including Microsoft SQL Server Management Studio. Kaspersky found that the attackers rely on the ClickFix social engineering method, which tricks victims into running malicious commands on their own devices.

The technique often presents users with fake error messages, verification steps, or repair instructions. Following those directions causes victims to execute code that installs the malware without realizing the command is malicious.

OkoBot targets seed phrases and wallet credentials

Among OkoBot’s modules, SeedHunter displays a fake recovery interface linked to hardware wallets such as Ledger and Trezor, according to Kaspersky. When users enter their recovery phrases into the fraudulent screen, the module sends the information to the malware operators.

A second module called MC Keylogger records keyboard input and monitors clipboard activity, allowing it to capture passwords, copied wallet addresses, and other credentials. OkoSpyware can track wallet passwords and record videos of open windows, giving attackers another way to observe activity on an infected device.

Once a recovery phrase is exposed, the attackers can use it to take control of the associated wallet and move its assets. Kaspersky warned that victims have little chance of recovering stolen cryptocurrency because blockchain transfers are generally irreversible.

The malware’s modular design also lets its operators collect different types of information from a single infected system. According to the security company’s findings, OkoBot can target both wallet access data and credentials connected to other services used on the device.

ClickFix attacks have also targeted crypto developers

OkoBot is the latest malware campaign found using ClickFix against the cryptocurrency sector. As crypto.news reported in April, North Korea’s state-backed Lazarus Group used the same technique in a macOS campaign known as “Mach-O Man.”

Citing research from CertiK, the report found that Lazarus sent fake online meeting invitations to fintech and crypto executives. Victims were instructed to paste supposed repair or verification commands into the macOS Terminal, which installed malware capable of stealing cryptocurrency and corporate information.

CertiK also found that the Mach-O Man toolkit deleted itself after running, making forensic analysis more difficult. The campaign combined social engineering with terminal-level commands instead of relying only on malicious file downloads.

Developer tools have provided another route into crypto systems. In May, crypto.news reported that TrapDoor malware was distributed through poisoned software packages targeting developers in cryptocurrency, decentralized finance, artificial intelligence, and security infrastructure.

According to that report, TrapDoor sought wallet data, API keys, cloud credentials, and SSH access tied to services and ecosystems including Coinbase, Binance, MetaMask, Brave, Solana, Sui, and Aptos. Researchers also found hidden prompts designed to manipulate Claude and Cursor into running fake security scans that exposed secrets and transmitted them to the attackers.

France’s gambling regulator has ordered internet service providers to block access to Polymarket, escalating a wave of restrictions aimed at prediction platforms operating outside local authorizations.

In a Friday press release, the Autorité nationale des jeux (ANJ) said prediction websites fall under illegal gambling rules if they are not authorized, adding that advertising or promoting such sites is a criminal offense punishable by fines of up to 100,000 euros.

Key takeaways

• France’s ANJ has ordered ISPs to block Polymarket, citing lack of authorization and illegal gambling promotion risks.
• The regulator argues Polymarket’s features resemble regulated gambling, but without “protective mechanisms” found in the legal market.
• ANJ also raised concerns about possible outcome manipulation, including allegations involving weather-related contracts.
• Polymarket has already been geoblocked in multiple regions, according to its own documentation.
• Regulatory scrutiny is not limited to Europe: similar legal disputes have played out in the US between state actors and federal authorities.

France moves to block Polymarket

The ANJ’s order targets access to Polymarket through internet service providers, framing the platform as an unauthorized gambling offering. According to the regulator, Polymarket’s operations are not authorized in France, and the advertising of gambling sites without permission constitutes a criminal offense.

The decision comes as prediction markets continue to gain mainstream attention. Polymarket, in particular, has grown rapidly over the last two years, with trading volume reaching billions of dollars, even as regulators worldwide question whether its event contracts are gambling products, unlicensed offerings, or something closer to financial instruments.

France’s action also reinforces a broader pattern of country-by-country enforcement. Polymarket access has been blocked in places including Singapore, Poland, Portugal, Hungary, Ukraine, Brazil, and Indonesia, while at press time Polymarket said it was geoblocked in 36 regions, based on its published API documentation.

ANJ cites “addictive” mechanics and missing safeguards

Beyond the authorization question, the ANJ’s reasoning focuses on how prediction products are experienced by users. The regulator said Polymarket offers “addictive features” that are comparable to those of legally regulated gambling, but it claims those features are “amplified by the absence of the protective mechanisms found in the legal gambling market.”

This distinction matters for investors and users because it goes to how regulators classify the product. When a platform resembles regulated gambling mechanics but lacks corresponding protections—such as consumer safeguards and oversight—authorities are more likely to pursue takedowns, advertising restrictions, and access blocking, even if the platform markets itself as a different kind of market.

Outcome manipulation concerns and investigation status

The ANJ also pointed to the risk of outcome manipulation in certain event contracts. It cited alleged rigging, including a specific example: bets tied to weather outcomes where the regulator said weather sensors may have been hacked.

“Some of the bets offered on this platform appeared to be rigged: for example, bets on the weather revealed that weather sensors may have been hacked.”

In addition, the cybercrime unit of the Paris Public Prosecutor’s Office opened an investigation in May 2026 and, according to the article’s account of the regulator’s findings, identified a lack of identity verification safeguards such as Know Your Customer checks.

For participants, this kind of enforcement pressure highlights a key operational fault line: regulators are not only focused on contract structure, but also on platform controls—especially around participant verification and the reliability of the information used to settle outcomes.

France builds on earlier warnings, while US regulators escalate

This is not France’s first move. Earlier coverage noted that the ANJ shared plans in November 2024 to block Polymarket after the platform allegedly failed to comply with national gambling laws, and the Friday decision follows through with the required ISP-level blocking.

The French action arrives amid an ongoing legal fight over prediction markets in the United States. On June 17, Kentucky sued five prediction market platforms, including Kalshi and Polymarket, alleging they were operating unlicensed sports betting platforms—according to the earlier reporting cited in the article. Additional states have followed suit. Separately, the Commodity Futures Trading Commission (CFTC) has sued New Mexico, arguing that state-level interference encroached on the federal regulator’s exclusive authority over federally regulated event contracts, as reflected in the referenced CFTC dispute.

Taken together, the US and France developments underscore a persistent regulatory tension: prediction markets sit at the intersection of gambling law, securities and commodities frameworks, and consumer protection rules. Even when platforms frame themselves as market infrastructure for forecasting rather than wagering, regulators appear willing to treat them as gambling-like products when participation mechanics and consumer risk resemble traditional betting.

As France implements the ISP blocking order, the next question for readers and market participants is how Polymarket and other affected platforms will adjust compliance, identity verification, and settlement-risk controls—and whether the broader trend shifts from geoblocking to more formal legal resolutions in major jurisdictions.

Ethereum has risen 1.8% to $1,845 after Rep. Bryan Steil raised hopes for a Senate vote on the CLARITY Act next week, while ETF inflows and firm chart support kept traders cautiously bullish.

Steil, who chairs the House Financial Services Subcommittee on Digital Assets, told FOX Business that the bill could reach the Senate floor in the coming week. Passage could place ETH under a digital commodity framework and establish federal rules for its trading and oversight.

During a July 17 hearing, Steil urged lawmakers to complete the legislation as the Senate prepares to consider it. “Let’s pass CLARITY,” he stated in remarks published by the House Financial Services Committee.

Polymarket traders raised the probability of the bill becoming law in 2026 to 39% from 30% on July 17. However, unresolved disputes over ethics rules and stablecoin yields have kept the odds below 50%.

Institutional flows have also improved. SoSoValue data showed that spot Ethereum ETFs attracted $105 million between July 13 and July 17, their strongest weekly inflow since April.

Ethereum’s decentralized finance activity has grown alongside the ETF demand. DeFiLlama placed the network’s total value locked at about $40.5 billion, up from roughly $36 billion at the start of July. The network also processed $978.9 million in decentralized exchange volume and 2.46 million transactions over the past 24 hours.

Ethereum must clear $1,854 to reopen the path toward $1,947

Ethereum’s daily chart shows a double-bottom structure formed around $1,511, with the neckline near $1,847. ETH briefly climbed to $1,947 before returning to test the neckline, which now overlaps with the 0.786 Fibonacci retracement at $1,853.82.

A daily close above $1,854 would place the recent $1,947 high and the 100-day exponential moving average near $1,939 back in play. The double-bottom structure has a measured target near $2,180, while crypto analyst Michaël van de Poppe expects $2,200 to $2,400 if the $1,780 support remains intact.

Daily momentum still favors buyers, although the pace has slowed. The MACD line stands at 35.57, above the 21.69 signal line, while the positive histogram has contracted to 13.88. The relative strength index sits at 57.15, leaving ETH below overbought territory.

On the 4-hour chart, Ethereum (ETH) remains inside an ascending channel that has guided the recovery since late June. Its lower boundary and the previous Supertrend support meet around $1,830, while the upper boundary extends toward $2,040. Chaikin Money Flow remains positive at 0.07, but the active Supertrend resistance at $1,908 must fall before buyers can retest the July high.

CoinGlass’ 48-hour liquidation heatmap places the nearest dense leverage cluster between $1,860 and $1,870. More positions sit around $1,900, while downside liquidity has accumulated near $1,810 and $1,790.

According to analyst Ted Pillows, the $1,820–$1,850 region will decide ETH’s next move.

“If Ethereum holds above it, expect another uptrend towards $1,950–$2,000.”

A break below $1,780 would weaken Ethereum’s recovery

Ethereum would lose its 4-hour channel if sellers force a close below $1,830. Such a move would expose the 50-day EMA near $1,812 and could trigger leveraged long liquidations around $1,810.

A deeper decline below the 61.8% Fibonacci level at $1,780.64 would weaken the double-bottom setup and open the 50% retracement at $1,729.24. Pillows also cited the escalating U.S.-Iran situation as a risk to the $1,820–$1,850 support zone.

Political uncertainty remains another invalidation risk. Failure to resolve the CLARITY Act’s ethics and stablecoin provisions could delay a Senate vote, remove the immediate catalyst behind ETH’s rebound, and place the $1,780 support under renewed pressure.

Kaspersky has uncovered a new malware framework targeting cryptocurrency investors.

Dubbed “OkoBot,” the malware initiates an infection chain that starts with social engineering tactics such as ClickFix, which tricks users into running malicious commands, or trojanized GitHub apps that deliver a backdoor to infected devices, the cybersecurity company wrote in a Wednesday report.

The malware can harvest crypto wallet files, browser data and user credentials, inject malicious extensions and capture wallet application windows to steal assets. Kaspersky said it identified multiple attacks involving this malware family since January 2026.

Kaspersky added that the malware framework evolved from “TookPS,” a malware campaign first identified in 2025 that distributed a Trojan downloader through fake software websites, and that it opens the door to copycat attacks.

It differs from prior campaigns by orchestrating all 20 malicious payloads via an SSH tunnel, which enables the remote transport of data from infected computers to remote machines controlled by attackers.

Original OkoBot infection chain. Source: Kaspersky

Fake LinkedIn recruitment campaigns target Web3 developers with malware

Separately, a new malware campaign is seeking to infiltrate the devices of Web3 developers via fake LinkedIn recruitment opportunities, according to SlowMist.

Attackers contact blockchain developers via LinkedIn, posing as Web3 recruiters. They then send fake GitHub repositories to victims, claiming they contained the minimum viable product that needed to be tried before the interview, the blockchain security company said in a Saturday report.

The workflow closely resembles a legitimate technical interview where developers pull code, install dependencies and launch a project, which makes it difficult to notice the attack, according to SlowMist.

Related: UK sentences 2 hackers tied to $115M crypto ransom scheme

The malware aims to deliver a complete “remote access trojan” that infects devices, enabling attackers to steal project keys, cloud credentials, or wallet extension data from these developers.

“This attack is not an isolated case,” wrote SlowMist, adding that recent incidents illustrate that “attackers are increasingly leveraging scenarios such as recruitment, code reviews and project collaborations to trick developers into actively running malicious repositories.”

The report came a day after SlowMist warned of a separate malware campaign targeting macOS users, aiming to steal their credentials and hijack their Telegram sessions to ultimately trick investors into entering their wallet recovery phrases through fake websites.

Magazine: Does Botanix’s failure prove Bitcoiners don’t care about DeFi?

Cathie Wood’s ARK Invest has bought $18.3 million of SpaceX shares after the stock fell 5.43% to a new post-IPO low, according to the firm’s July 17 trading report.

According to ARK’s daily disclosure, four of its actively managed exchange-traded funds purchased a combined 147,623 SpaceX shares as the stock closed Friday at $123.99. During the session, shares dropped as low as $122.12.

The ARK Innovation ETF made the largest purchase, adding 95,129 shares worth about $11.8 million based on Friday’s closing price. ARK’s Autonomous Technology & Robotics ETF bought 30,464 shares valued at $3.78 million, while its Space Exploration & Innovation ETF added 12,611 shares worth around $1.56 million.

Completing the purchase, the ARK Next Generation Internet ETF acquired another 9,419 SpaceX shares valued at approximately $1.17 million, according to the same disclosure.