Trojanized installers for the TOR anonymity browser are being used to target users in Russia and Eastern Europe with clipper malware designed to siphon cryptocurrencies since September 2022.
https://thehackernews.com/2023/03/trojanized-tor-browser-installers.html