Discover and read the best of Twitter Threads about #OnionPoison
Most recents (2)
1/4 #OnionPoison the installation of the malicious Tor Browser is configured to be less private than the original Tor. Unlike the legitimate one, the infected Tor Browser stores browsing history and data entered into website forms. @0xggus @torproject securelist.com/onionpoison-in…
2/4 #OnionPoison more importantly, one of the libraries bundled with the malicious Tor Browser is infected with spyware that collects various personal data and sends it to a command and control server.
3/4 #OnionPoison the spyware also provides the functionality to execute shell commands on the victim machine, giving the attacker control over it.
Beware of links from popular YouTube videos, as they may contain #malware. We found such a video (64K views, 180K subscribers) that has a link to a Tor Browser installer in the description. That installer comes with a previously unknown spyware that we dubbed #OnionPoison. [1/4] 
The malicious Tor installation has been configured to be less private (it stores browsing history, login data, etc.), and its freebl3.dll library is infected with malware. When the browser is launched, this library contacts the C2 server to receive a second stage implant. [2/4]
It's interesting that the server sends the second stage implant only if the victim's IP is from #China, so the campaign targets only Chinese-speaking users. Features of the spyware include collecting system information, stealing browser history and executing shell commands. [3/4]
