The Kaspersky researchers dubbed the campaign “OnionPoison” after Tor’s onion routing technique for anonymous communications, adding: “Unlike the legitimate one, the infected Tor Browser stores browsing history and data entered into website forms. The video with the link to the malicious installer first appeared on the YouTube channel in January, with victims starting to appear in March it has been viewed over 64,000 times. In this case, the Kaspersky researchers say their telemetry detected the malicious installers via a link on a popular Chinese-language YouTube channel devoted to anonymity on the internet that has over 180,000 subscribers. The website for the Tor browser is banned in China, so users often resort to using third-party sites to download the contraband browser. Kaspersky researchers noticed a rather clever way threat actors are deceiving users in China into downloading a malicious Tor browser installer that can be used to track the history and location of its victims. The YouTube app logo is seen on a television screen.

Tor browser download video