A trojanized version of the Tor Browser is targeting dark web market shoppers to steal their cryptocurrency and tracks the websites they visit. ESET researchers say the attacks target users of the three largest Russian-speaking darknet markets. More than 860 transactions are registered to three of the attackers’ wallets, which received about $40,000 in Bitcoin cryptocurrency. The script can modify the page by stealing content in forms, hiding original content, showing fake messages, or adding its own content. For the payload they observed, the script also alters the details for the Qiwi payment service provider.
Source: https://www.bleepingcomputer.com/news/security/malicious-tor-browser-steals-cryptocurrency-from-darknet-market-users/