SeedHunter is a module of the OkoBot framework that injects into legitimate wallet apps (Trezor Suite, Ledger Wallet, Ledger Live) to display fake recovery pages. It can wait for a hardware wallet to be plugged in before showing the phishing page, and exfiltrates typed phrases via JSON with RC4 encryption.