Malicious Tor Browser spreads through YouTube

A malicious Tor Browser installer distributed through a popular Chinese-language YouTube channel is the target of a multi-million dollar cyber-attack, according to security firm Kaspersky, which has now identified more than 1,000 victims.

REFERENCE: https://securelist.com/onionpoison-infected-tor-browser-installer-youtube/107627/

TAGS: onionpoison, onion, social engineering, tor, youtube, tor browser, c2 server, china

TARGETED COUNTRY: China

ATT&CK IDS: T1090 - Proxy, T1104 - Multi-Stage Channels, T1059 - Command and Scripting Interpreter, T1072 - Software Deployment Tools, T1113 - Screen Capture, T1016 - System Network Configuration Discovery, T1140 - Deobfuscate/Decode Files or Information, T1573 - Encrypted Channel

Read More:

https://otx.alienvault.com/pulse/633c2ebd5a54a44fe8b3e14d