Tor proxy services allow users to access Tor domains hosted on the Tor network without needing to install the Tor Browser. Operators of Onion.top Tor-to-web proxy service are secretly replacing Bitcoin addresses with their own. Ransomware authors have started taking precautionary measures against all Tor-based proxy services, researchers say. The best way to avoid ransomware infections is to avoid opening suspicious files received from unknown persons, or keeping regular backups of important (or all) files, according to experts.
Source: https://www.bleepingcomputer.com/news/security/tor-to-web-proxy-caught-replacing-bitcoin-addresses-on-ransomware-payment-sites/