A malicious Tor browser is helping scammers steal bitcoin, researchers say

The attacks comes as the Tor Project is trying to enhance trust in the anonymity browser.

Thieves are using malware that masquerades as Tor, the anonymizing internet browser, to steal money from Russian-speaking people on the dark web, researchers said Friday.

The operation uncovered by researchers at Slovakian cybersecurity company ESET has netted the unidentified attackers some $40,000 in bitcoin so far, but the amount could be larger.

“They likely stole more in Qiwi,” said Robert Lipovsky, a senior malware researcher at ESET, referring to a Russian payment service.

The insidious attack is a reminder that hackers can upend the privacy and security users expect from software by tricking them into downloading malicious code. Tor is used by everyone from human rights defenders and journalists to criminals trying to hide activities like drug sales and child pornography from law enforcement. This effort, only the latest malicious operation exploiting users who rely on the software, comes as the Tor Project is seeking to spread awareness about Tor, and increase trust in the notoriously unreliable technology.

In this case, the attackers were after a number of Russian-speaking users.

“It was not targeted against known, specific people,” Lipovsky said. “It was opportunistic, but targeted dark net shoppers, people searching for keywords regarding drugs, cryptocurrencies [and] also censorship bypass or Russian opposition politicians.”

The hackers are duping victims by using two websites. The first claims a user’s version of Tor is outdated. Upon clicking, the user is redirected to a second site that triggers a Windows installer to download the malware.

Instead of altering the Tor browser’s binary components, attackers are changing settings to the browser and its HTTPS Everywhere extension. That bit of stealth has let them go unnoticed for years, according to ESET. The domains first appeared in 2014.

“Non-technically-savvy people probably won’t notice any difference between the original version and the trojanized one,” said Anton Cherepanov, another senior malware researcher at ESET.

ESET said it couldn’t determine who was responsible.

“We will send trademark takedown notices to the domains, and we will be adding information to our user support site about identifying these types of scams,” a spokesperson for the Tor Project said in a statement. “As always, it is important for everyone downloading our software, or any software, to ensure it comes from official sources.”

Silas Cutler, reverse engineering lead at Chronicle, said the activity was unusual in that most attacks involving Tor he has studied are focused on the actual Tor infrastructure, with the goal of de-anonymizing the user.

“There’s something unique about attacks where operators are able to exploit a trusted tool — simply by making distinct changes, without heavy-handedly adding malware or backdoors that could be detected by antivirus or [endpoint detection and response] software,” Cutler told CyberScoop.

The criminals are attracting attention. Their accounts on Pastebin, a text-storage site, have been viewed more than a half million times, according to ESET.

One measure of the attackers’ ambition: the JavaScript payload they are using has been spotted on three of the biggest Russian-speaking dark web forums, researchers said.

This story has been updated to include a comment from the Tor Project.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• The Collective Cyber Defense letter wrote your next vendor questionnaire

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure

• Election official says Tina Peters would be consultant, won’t have access to election systems