Anyone using Tor Browser - be careful about the latest update.

Apparently, someone tampered with the Tor.exe
Fortunately, the Trojan was detectable - even by Windows Defender (if up to date).

Mine got updates last night and I am not seeing any of the issues mentioned there. I’ll have to keep an eye on it. Thanks.

There was a new update - circulating couple of hours ago (on top of the other one). Someone probably hacked their server (or could be an internal tampering). Hard to say since so far - there's no official response (quite silent about it too). Which personally, i find more bothersome/concerning than the possibility of being hacked (i mean - the lack of official answers leaves room for all kinds of speculations - like the possibility of actually being an inside job). One thing's for sure - the number of people affected is piling up - as can be seen in their official Reddit.

Besides Microsoft's scanning engine, all other top-tier engine detections in today's VirusTotal scan are absent with positive hits, and have remained that way for 4+ days. Until an independent and thorough analysis is completed, this seems to appear like a false positive.

Reference: VirusTotal

Incidentally, today's VT scan of the torbrowser-install-win64-12.5.6_ALL.exe file is clean…

HTH

neves said:

so far - there's no official response (quite silent about it too). Which personally, i find more bothersome/concerning than the possibility of being hacked (i mean - the lack of official answers leaves room for all kinds of speculations - like the possibility of actually being an inside job).

Click to expand...

To be fair, a company/organisation should give no less information than saying “we’re looking in to it” But also to be fair, expecting a company to give reason to an incident without a proper analyses of a situation is unreasonable. I’d rather a limited response until the company/organisation is sure as apposed to having my time wasted by a company with unsubstantiated nonsense, that’s what Reddit is for.

Here's a link to the Total Virus upload: VirusTotal

The "experts" on there already flagged the event as false positives, although it's still probably best to wait for statements from the project, if any is forthcoming. Tor has also been repeatedly flagged in the past.

Hello @neves and all:

Microsoft's engine for VirusTotal has now removed their Trojan.Win32.Malgent!MTB detection.

I wonder what the chances are of the other four (4) engine owners correcting their detection results.

HTH