Kaspersky Uncovers OkoBot Malware Targeting Crypto Investors

Cryptocurrency transactions are typically difficult to reverse once recorded on-chain, making industry professionals with access to wallet credentials high-risk targets for social engineering. Chainalysis estimates that compromises of personal crypto wallets caused $713 million in losses in 2025. The incident also shows how legitimate productivity tools such as Obsidian and their community plugins can be turned into entry points for corporate breaches.

Elastic Security Labs disclosed the REF6598 campaign on April 14, 2026. Scammers posed as a venture capital firm, initially contacting finance and crypto professionals on LinkedIn before moving conversations to Telegram and persuading victims to open an attacker-controlled Obsidian cloud vault and sync its plugins. The campaign targeted both Windows and macOS systems and deployed the PHANTOMPULSE remote access trojan. Elastic said it intercepted the attack at an early stage.