They seem to possibly targeting the tor browser bundle