A malicious app disguised as a modified version of the Tor Browser is targeting users looking to buy illegal products off the Dark Web. The malicious app is distributed using YouTube videos that teach non-technical users how to buy products from a Dark Web marketplace called The Rodeo. All content on the site is downloaded from a remote FTP or web server, where it’s usually stored in text or Base64 or encrypted HTML files. The site’s operator allows users to place orders to various vendors, but all messages reach the same person, who then provides victim’s with Bitcoin addresses.
Source: https://www.bleepingcomputer.com/news/security/scammer-uses-fake-tor-browser-to-lure-victims-to-supposed-dark-web-marketplace/