Discover and read the best of Twitter Threads about #onionpoison

Most recents (2)

1/4 #OnionPoison the installation of the malicious Tor Browser is configured to be less private than the original Tor. Unlike the legitimate one, the infected Tor Browser stores browsing history and data entered into website forms. @0xggus @torproject securelist.com/onionpoison-in…
2/4 #OnionPoison more importantly, one of the libraries bundled with the malicious Tor Browser is infected with spyware that collects various personal data and sends it to a command and control server.
3/4 #OnionPoison the spyware also provides the functionality to execute shell commands on the victim machine, giving the attacker control over it.
Read 5 tweets
Beware of links from popular YouTube videos, as they may contain #malware. We found such a video (64K views, 180K subscribers) that has a link to a Tor Browser installer in the description. That installer comes with a previously unknown spyware that we dubbed #OnionPoison. [1/4]
The malicious Tor installation has been configured to be less private (it stores browsing history, login data, etc.), and its freebl3.dll library is infected with malware. When the browser is launched, this library contacts the C2 server to receive a second stage implant. [2/4]
It's interesting that the server sends the second stage implant only if the victim's IP is from #China, so the campaign targets only Chinese-speaking users. Features of the spyware include collecting system information, stealing browser history and executing shell commands. [3/4]
Read 4 tweets

Related hashtags

Did Thread Reader help you today?

Support us! We are indie developers!


This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3.00/month or $30.00/year) and get exclusive features!

Become Premium

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!