Bitcoin and other major cryptocurrencies have become a favorite target of hackers and scammers in recent years, as a result of the explosion in bitcoin prices.
The price of bitcoin, which has doubled since the beginning of the year, has recently fallen, but not enough to deter cybercriminals.
Now, researchers are warning that a version of the widely used Tor Browser is being used to spy on users and steal their bitcoins.
The total amount of stolen funds has reached 4.8 bitcoins, worth around $40,000 at current prices – although experts from cybersecurity firm ESET have warned that the actual amount could be much higher as the campaign went unnoticed for many years.
“This malware allows the criminals behind this attack to see which website the victim is visiting. Theoretically, they could change the content of the page they visited, intercept data the victim fills in forms, and display fake messages. We have only seen one specific operation, which changes cryptocurrency wallets,” said Anton Cherepanov, ESET senior malware researcher.
The infected version of the Tor Browser, most commonly used to access the so-called dark web, where people can buy illegal goods and services in exchange for bitcoin, has targeted Russian users of the anonymous Tor network and has disguised itself as an official browser – Cherepanov warns that “non-tech-savvy people will probably not notice any difference between the original version and the infected one.”
ESET researchers found that the malware targets three of the largest Russian-speaking dark web marketplaces, changing the details of Russia's popular money transfer service "QIWI" or bitcoin wallets found on pages of these marketplaces.
When a user visits their profile page to add bitcoin to the dark web, this Tor Browser changes the original bitcoin address to one controlled by criminals.
“During our investigation, we identified three wallets used in this scam from 2017. Each such wallet contains a relatively large number of small transactions, we believe this confirms that these wallets were indeed used by the infected Tor Browser,” Cherepanov said.
“It should be noted that the actual amount of stolen money is higher, because the infected Tor Browser also changes QIWI wallets.”
As bitcoin and cryptocurrencies have become widely used and their value has risen, bitcoin scams and cyberattacks have increased.
Earlier this week, researchers warned that a piece of malware designed to extort victims called “Save Yourself” could compromise bitcoin wallets.
Meanwhile, the cryptocurrency industry faced a blow earlier this week when it was revealed that pedophiles from around the world had been exchanging child abuse images for bitcoin on the dark web in one of the biggest child pornography discoveries ever made.
