Leonid Bezvershenko Profile picture
Studying math, reversing and Twitter... | Security Researcher @ Kaspersky, GReAT | Tweets are my own
Oct 4, 2022 4 tweets 3 min read
Beware of links from popular YouTube videos, as they may contain #malware. We found such a video (64K views, 180K subscribers) that has a link to a Tor Browser installer in the description. That installer comes with a previously unknown spyware that we dubbed #OnionPoison. [1/4] The malicious Tor installation has been configured to be less private (it stores browsing history, login data, etc.), and its freebl3.dll library is infected with malware. When the browser is launched, this library contacts the C2 server to receive a second stage implant. [2/4]