Clipboard-injecting malware disguises itself as Tor browser, steals cryptocurrency • Graham Cluley

Clipboard-injecting malware disguises itself as Tor browser, steals cryptocurrency

Think about you reside in Russia and wish to use the Tor browser to anonymise your looking of the online.

There’s an issue. Many individuals in Russia discover their entry to the official Tor web site is blocked by their ISP.

So, what do you do?

Effectively, you might attempt to discover someplace aside from the official Tor website to obtain Tor from.

However is the model of Tor you downloaded from a torrent or third-party website reliable?

Based on a report from Russian anti-virus outfit Kaspersky, maybe not.

EmailSignal as much as our e-newsletter
Safety information, recommendation, and ideas.

Kaspersky boffins say that they’ve seen malware distributed as copies of Tor, which has stolen roughly US $400,000 value of cryptocurrency from virtually 16,000 customers worldwide.

Based on the researchers, boobytrapped installers supply Tor with a collection of regional language packs, together with Russian.

Tor installer malware
Tor installer malware. Supply: Kaspersky

As soon as put in, the malware snoops in your Home windows clipboard.

If it sees in your clipboard what it believes to be an handle for a cryptocurrency pockets, it replaces it with an handle controller by the attacker.

The upshot is that you simply may suppose you might be shifting cryptocurrency into your personal pockets, however actually you’re placing it into the arms of a cybercriminal.


I used to be amused to see the staff at Kaspersky counsel a merely methodology to verify whether or not you system was compromised:

Kind or copy the next “Bitcoin handle” in Notepad: bc1heymalwarehowaboutyoureplacethisaddress

Now press Ctrl+C and Ctrl+V. If the handle modifications to one thing else — the system is probably going compromised by a clipboard-injector sort of malware, and is harmful to make use of.

Clipboard injection
Malware altering the pockets handle via clipboard injection. Supply: Kaspersky

I don’t suppose I’d depend on that check alone to inform if my pc was compromised by the clipboard-injecting malware, however it’s an attention-grabbing factor to attempt.

In case you’re in any doubt, it’s maybe most secure to all the time assume your pc is compromised.

Discovered this text attention-grabbing? Follow Graham Cluley on Twitter or Mastodon to learn extra of the unique content material we put up.

Graham Cluley is a veteran of the anti-virus trade having labored for quite a few safety corporations for the reason that early Nineteen Nineties when he wrote the primary ever model of Dr Solomon’s Anti-Virus Toolkit for Home windows. Now an impartial safety analyst, he commonly makes media appearances and is a global public speaker on the subject of pc safety, hackers, and on-line privateness.
Comply with him on Twitter at @gcluley, on Mastodon at @[email protected], or drop him an e-mail.