Tor browser provides anonymity on the web, allows you to visit websites using the Tor network, where it is possible to hide real user data.

According to the experts from ESET, the malicious version of Tor is distributed via a link placed on Internet forums, more precisely two, that impersonate the original installer page. The software installation package is undetectable by antivirus programs, and is modified in a way that disables automatic update functionality.

Cybercriminals modified the HTTPS Everywhere extension so that it contains a JavaScript that loads on every visited website.

According to experts from ESET the script modifies QIWI online money transfer service and cryptocurrency wallets used in darknet.

The malicious version of Tor has been downloaded at least 500,000 times.