While performing regular threat hunting activities, Kaspersky identified multiple downloads of previously unclustered malicious Tor Browser installers. According to their telemetry, all the victims targeted by these installers are located in China. As the Tor Browser website is blocked in China, individuals from this country often resort to downloading Tor from third-party websites. In this case, a link to a malicious Tor installer was posted on a popular Chinese-language YouTube channel devoted to anonymity on the internet. The channel has more than 180,000 subscribers, while the view count on the video with the malicious link exceeds 64,000. The video was posted in January 2022, and the campaign’s first victims started to appear in Kaspersky’s telemetry in March 2022.
The installation of the malicious Tor Browser is configured to be less private than the original Tor. Unlike the legitimate one, the infected Tor Browser stores browsing history and data entered into website forms. More importantly, one of the libraries bundled with the malicious Tor Browser is infected with spyware that collects various personal data and sends it to a command and control server. The spyware also provides the functionality to execute shell commands on the victim machine, giving the attacker control over it.
Kaspersky decided to dub this campaign ‘OnionPoison’, naming it after the onion routing technique that is used in Tor Browser.
https://securelist.com/onionpoison-infected-tor-browser-installer-youtube/107627/