By 
Security researchers have identified multiple infections via malicious Tor Browser installers spread via an explanatory video about the Darknet on YouTube.
Kaspersky which found this said in an advisory that the channel in question has more than 180,000 subscribers, while the view count on the video with the malicious link exceeds 64,000.
The cybercriminals added a link to an infected version of Tor Browser in the description bar of the video, and the campaign dubbed as 'OnionPoison' by the security firm, spread malware that could collect victims’ data and obtain complete control over their computers via shell commands.
Most of the affected users were from China. The Tor Browser website is blocked in China, so the people from this country often resort to downloading Tor from third–party websites. The cyber–criminals spread their malicious activity via such resources.
According to Kaspersky, the analyzed version of Tor Browser is configured to be less private than the original software tool.
The malicious variant stored browsing history and all the data the user entered into website forms, besides it also distributed spyware to collect personal data and send it to the hackers’ server.
However, OnionPoison does not seem to show a particular interest in collecting users’ passwords or wallets. Instead, they are more interested in collecting victims’ identifying information which can be used to track down the victims’ identities, such as browsing histories, social network account IDs and WiFi networks.
Kaspersky stated that the attackers can gather information on the victim’s personal life, his family or home address. Additionally, there are cases when the attacker used the obtained information to blackmail the victim.
Kaspersky warned companies and individuals against downloading software from suspicious third–party websites to reduce the risks of becoming victims of such malicious campaigns.
Those who cannot use official websites must verify the authenticity of installers downloaded from third–party sources by examining their digital signatures.
The advisory comes months after Tor Project updated its flagship anonymizing browser to make it easier for users to evade government attempts to block its use in various regions.
