News Malicious Tor Browser Steals Cryptocurrency from Darknet Market Users

Malicious Tor Browser Steals Cryptocurrency from Darknet Market Users

-

- Advertisment -

A trojanized version of the Tor Browser is targeting dark web market shoppers to steal their cryptocurrency and tracks the websites they visit.

More than 860 transactions are registered to three of the attackers’ wallets, which received about $40,000 in Bitcoin cryptocurrency.

Careful impersonation

The malicious Tor Browser is actively promoted as the Russian version of the original product through posts on Pastebin that are have been optimized to rank high in queries for drugs, cryptocurrency, censorship bypass, and Russian politicians.

Spam messages also help the actor(s) distribute the trojanized variant, which is delivered from two domains claiming to provide the official Russian version of the software.

Cybercriminals were careful with selecting the two domain names (created in 2014) since to a Russian user they appear to be the real deal:

  • tor-browser[.]org
  • torproect[.]org – for Russian-speaking visitors, the missing “j” may be seen as a transliteration from Cyrillic

Furthermore, the design of the pages mimic, to some extent, the official site of the project. Landing on one of these pages shows the visitor a warning that their browser is updated, regardless of the version they run.

Translated into English, the message reads:

“Your anonymity is in danger! WARNING: Your Tor Browser is outdated. Click the button “Update”

In Pastebin messages, the cybercriminals advertise that users would benefit from anti-captcha feature allowing them to get faster to the destination.

This is not true, though. Underneath this Tor Browser impersonator is version 7.5 of the official project, released in January 2018.

Getting the cryptocurrency

The downloaded script can modify the page by stealing content in forms, hiding original content, showing fake messages, or add its own content.

These capabilities allow the script to replace in real-time the destination wallet for cryptocurrency transactions. The JavaScript observed by ESET does exactly this.

The targets are users of the three largest Russian-speaking darknet markets, the researchers say. For the payload they observed (image above), the script also alters the details for the Qiwi payment service provider.

When victims add Bitcoin funds to their account, the script jumps in and changes the wallet address with one belonging to the attackers.

Since cryptocurrency wallets are a large string of random characters, users are likely to miss the swap.

Darknet profile with altered Bitcoin address

At the moment of publishing, the three cryptocurency wallets controlled by the attackers recorded 863 transactions. These are small transfers, supporting the theory that the funds came via the trojanized Tor Browser.

One of them received more than $20,000 from over 370 transactions. The largest balance, though, is currently around $50 in one wallet and less than $2 in the other two.

The three wallets have been used for this purpose since 2017, the researchers found. Although the amount of Bitcoins that passed through these wallets is 4.8, the total proceedings for the attackers is likely higher because Qiwi payment details are also altered.

Source

LEAVE A REPLY

Please enter your comment!
Please enter your name here

Latest news

Ethereum Price Sees $500 for the First Time in Two-and-a-half Years

First launched in 2014, Ethereum or Ether is one of the oldest altcoins and probably the most...

Banking Sector is Ready for a Tech Revolution With Cryptocurrency

When our world is going through a massive change due to COVID-19blow, it is very likely that...

OpenDAO’s Bridge Opens New Possibility for Mass Adoption of DeFi

When Satoshi Nakamoto officially created Bitcoin on January 3, 2009, his vision for the digital asset was...

Crypto’s price surge was mostly due to limited information – here’s why

As the world becomes more and more digitized, the usage of one of the most popular cryptocurrencies,...
- Advertisement -

U.S. Authorities Seized Bitcoin Worth a Total of $1 billion

The cryptocurrencies were in the possession of a person who had hacked Silk road, which was detected...

Top 12 BEST Crypto Trading Bots for 2020

TL;DR: In this article, we present a list of the best Crypto Trading Bots of 2020. If...

Must read

- Advertisement -

Read Next
Recommended to you