It can be useful to remember that social engineering succeeds much better when its marks are stressed or hurried. That appears to be the case with an ongoing scam campaign that lays its trap for Russian-speaking victims. Researchers at ESET found a Trojanized version of the TOR browser that displays a warning that their browser is out of date, that their anonymity is at risk, and that they need to upgrade to keep themselves safe. The victims are invited to click through to a site where they can bring their TOR browser up to the latest standard.
The urgency derives from where the victims are found: shopping on the Darknet. Not everything on the Darknet is nefarious or malicious, but a good bit of it is, and the markets found there often deal in contraband, both physical, like drugs or weapons, and virtual, like illicit pornography. The warning page the scammers display shows a sympathetic concern for the user. It urges them to keep their anonymity reliable and up-to-date because, of course they would not want to draw the attention of the police. Someone who knew they were up to something the authorities frown on might well be rattled into hastily clicking the update button.
Should the victim click through, they would be taken to a site that installs e-wallet looting malware. The crooks are mostly after Qiwi accounts, but they’ll take Bitcoin as well. Qiwi is an online payment service headquartered in Cyprus but serving mostly Russian users.
As is so often the case, social engineering takes advantage of fear, in this case the fear of being caught, and of haste, the felt need to act now. Even though it may be a good bet that an organization’s employees are not themselves up to no good online, it remains a good idea to help them become aware of these tactics so they can resist being rushed into a mistake. New school security awareness training can increase their ability to withstand the scare tactics scammers use.
ESET’s We Live Security has the story:
https://www.welivesecurity.com/2019/10/18/fleecing-onion-trojanized-tor-browser/
