Tampered devices sold through one Southeast Asia reseller carried a circuit board that photographed recovery phrases.
The OkoBot malware framework injects fake recovery seed phrase pages directly into legitimate Ledger and Trezor desktop applications on Windows…