{"id":43499,"date":"2015-05-23T19:09:02","date_gmt":"2015-05-24T02:09:02","guid":{"rendered":"https:\/\/blogs.mcafee.com\/?p=43499"},"modified":"2025-06-02T20:39:02","modified_gmt":"2025-06-03T03:39:02","slug":"meet-tox-ransomware-for-the-rest-of-us","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/meet-tox-ransomware-for-the-rest-of-us\/","title":{"rendered":"Meet &#8216;Tox&#8217;: Ransomware for the Rest of Us"},"content":{"rendered":"<p>The packaging of malware and malware-construction kits for cybercrime &#8220;consumers&#8221; has been a long-running trend. Various turnkey kits that cover remote access plus botnet plus stealth functions are available just about anywhere. Ransomware, though very prevalent, has not yet appeared in force in easy-to-deploy kits.<\/p>\n<p>But now we have Tox&#8211;and it&#8217;s free.<\/p>\n<p><a href=\"https:\/\/securingtomorrow.mcafee.com\/mcafee-labs\/meet-tox-ransomware-for-the-rest-of-us\/attachment\/toxlogo\" rel=\"attachment wp-att-43516\"><img loading=\"lazy\" decoding=\"async\" class=\"alignleft wp-image-43516 size-medium\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/toxlogo-300x111.png\" alt=\"toxlogo\" width=\"300\" height=\"111\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/toxlogo-300x111.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/toxlogo.png 647w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><a href=\"https:\/\/securingtomorrow.mcafee.com\/mcafee-labs\/meet-tox-ransomware-for-the-rest-of-us\/attachment\/tox2_2\" rel=\"attachment wp-att-43501\"><br \/>\n<\/a><\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>While sifting though our stream of &#8220;dark web&#8221; data, McAfee Labs found Tox on May 19. It was updated on May 21 with a new FAQ and an updated design. But the core did not change.<\/p>\n<p><a href=\"https:\/\/securingtomorrow.mcafee.com\/mcafee-labs\/meet-tox-ransomware-for-the-rest-of-us\/attachment\/tox2_1\" rel=\"attachment wp-att-43500\"><img loading=\"lazy\" decoding=\"async\" class=\"alignleft wp-image-43500 size-large\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/tox2_1-1024x531.png\" alt=\"tox2_1\" width=\"1024\" height=\"531\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/tox2_1-1024x531.png 1024w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/tox2_1-300x156.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/tox2_1.png 1266w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/a><\/p>\n<p>&nbsp;<\/p>\n<h2><strong>Salient Points:<\/strong><\/h2>\n<ul>\n<li>Tox is free. You just have to register on the site.<\/li>\n<li>Tox is dependent on TOR and Bitcoin. That allows for some degree of anonymity.<\/li>\n<li>The malware works as advertised.<\/li>\n<li>Out of the gate, the standard of antimalware evasion is fairly high, meaning the malware&#8217;s targets would need additional controls in place (HIPS, whitelisting, sandboxing) to catch or prevent this.<\/li>\n<\/ul>\n<p>Once you register for the product, you can create your malware in three simple steps.<\/p>\n<ul>\n<li>Enter the ransom amount. (The site takes 20% of the ransom.)<\/li>\n<li>Enter your &#8220;cause.&#8221;<\/li>\n<li>Submit the\u00a0captcha.<\/li>\n<\/ul>\n<p><a href=\"https:\/\/securingtomorrow.mcafee.com\/mcafee-labs\/meet-tox-ransomware-for-the-rest-of-us\/attachment\/tox_config_screen1\" rel=\"attachment wp-att-43510\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-43510\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/TOX_config_screen1.png\" alt=\"TOX_config_screen1\" width=\"964\" height=\"952\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/TOX_config_screen1.png 964w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/TOX_config_screen1-300x296.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/TOX_config_screen1-32x32.png 32w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/TOX_config_screen1-64x64.png 64w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/TOX_config_screen1-96x96.png 96w\" sizes=\"auto, (max-width: 964px) 100vw, 964px\" \/><\/a><\/p>\n<p>&nbsp;<\/p>\n<p><a href=\"https:\/\/securingtomorrow.mcafee.com\/mcafee-labs\/meet-tox-ransomware-for-the-rest-of-us\/attachment\/tox2_2\" rel=\"attachment wp-att-43501\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-large wp-image-43501\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/tox2_2-1024x630.png\" alt=\"tox2_2\" width=\"1024\" height=\"630\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/tox2_2-1024x630.png 1024w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/tox2_2-300x184.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/tox2_2.png 1254w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/a><\/p>\n<p>This process creates an executable of about 2MB that is disguised as a .scr file. Then the Tox &#8220;customers&#8221; distribute and install as they see fit. The Tox site (on the TOR network) will track the installs and profit. To withdraw funds, you need only supply a receiving Bitcoin address.<\/p>\n<p><a href=\"https:\/\/securingtomorrow.mcafee.com\/mcafee-labs\/meet-tox-ransomware-for-the-rest-of-us\/attachment\/tox_download_virus_file\" rel=\"attachment wp-att-43512\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-43512\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/TOX_download_virus_file.png\" alt=\"TOX_download_virus_file\" width=\"962\" height=\"956\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/TOX_download_virus_file.png 962w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/TOX_download_virus_file-150x150.png 150w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/TOX_download_virus_file-300x298.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/TOX_download_virus_file-32x32.png 32w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/TOX_download_virus_file-64x64.png 64w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/TOX_download_virus_file-96x96.png 96w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/TOX_download_virus_file-128x128.png 128w\" sizes=\"auto, (max-width: 962px) 100vw, 962px\" \/><\/a><\/p>\n<p>Upon execution, the malware encrypts the victims&#8217; data and prompts them for the ransom, including the Bitcoin address for sending payment.<\/p>\n<p><a href=\"https:\/\/securingtomorrow.mcafee.com\/mcafee-labs\/meet-tox-ransomware-for-the-rest-of-us\/attachment\/tox_client_exe_1\" rel=\"attachment wp-att-43505\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-large wp-image-43505\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/TOX_client_exe_1-1024x618.png\" alt=\"TOX_client_exe_1\" width=\"1024\" height=\"618\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/TOX_client_exe_1-1024x618.png 1024w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/TOX_client_exe_1-300x181.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/TOX_client_exe_1.png 1503w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/a><\/p>\n<p>&nbsp;<\/p>\n<p><a href=\"https:\/\/securingtomorrow.mcafee.com\/mcafee-labs\/meet-tox-ransomware-for-the-rest-of-us\/attachment\/tox_client_encrypting\" rel=\"attachment wp-att-43504\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-43504\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/TOX_client_encrypting.png\" alt=\"TOX_client_encrypting\" width=\"672\" height=\"323\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/TOX_client_encrypting.png 672w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/TOX_client_encrypting-300x144.png 300w\" sizes=\"auto, (max-width: 672px) 100vw, 672px\" \/><\/a><\/p>\n<p>&nbsp;<\/p>\n<p><a href=\"https:\/\/securingtomorrow.mcafee.com\/mcafee-labs\/meet-tox-ransomware-for-the-rest-of-us\/attachment\/tox_client_encrypt_message_1\" rel=\"attachment wp-att-43503\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-large wp-image-43503\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/TOX_client_encrypt_message_1-1024x657.png\" alt=\"TOX_client_encrypt_message_1\" width=\"1024\" height=\"657\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/TOX_client_encrypt_message_1-1024x657.png 1024w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/TOX_client_encrypt_message_1-300x193.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/TOX_client_encrypt_message_1.png 1159w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/a><\/p>\n<p>&nbsp;<\/p>\n<p><strong>Technical Information<\/strong><\/p>\n<p>Although easy to use and functional, the malware appears to lack complexity and efficiency\u00a0within the code.<\/p>\n<figure id=\"attachment_43536\" aria-describedby=\"caption-attachment-43536\" style=\"width: 738px\" class=\"wp-caption aligncenter\"><a href=\"https:\/\/securingtomorrow.mcafee.com\/mcafee-labs\/meet-tox-ransomware-for-the-rest-of-us\/attachment\/pe_sections-jpg\" rel=\"attachment wp-att-43536\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-43536 size-full\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/pe_sections.JPG.jpeg\" alt=\"pe_sections.JPG\" width=\"738\" height=\"176\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/pe_sections.JPG.jpeg 738w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/pe_sections.JPG-300x72.jpeg 300w\" sizes=\"auto, (max-width: 738px) 100vw, 738px\" \/><\/a><figcaption id=\"caption-attachment-43536\" class=\"wp-caption-text\">Tox malware portable executable sections.<\/figcaption><\/figure>\n<p>The developer has left several identifying strings within the code. Examples:<\/p>\n<ul>\n<li>C:\/Users\/Swogo\/Desktop\/work\/tox\/cryptopp\/secblock.h<\/li>\n<li class=\"p1\"><span class=\"s1\">C:\/Users\/Swogo\/Desktop\/work\/tox\/cryptopp\/filters.h<\/span><\/li>\n<li class=\"p1\"><span class=\"s1\">C:\/Users\/Swogo\/Desktop\/work\/tox\/cryptopp\/cryptlib.h<\/span><\/li>\n<li class=\"p1\"><span class=\"s1\">C:\/Users\/Swogo\/Desktop\/work\/tox\/cryptopp\/simple.h<\/span><\/li>\n<\/ul>\n<p>Tox-generated malware is compiled in MinGW and uses AES to encrypt client files via the Crypto++ library. \u00a0The Microsoft CryptoAPI is used for key generation.<\/p>\n<h2><strong>Network Information<\/strong><\/h2>\n<p>The malware first downloads Curl and the TOR client:<\/p>\n<ul>\n<li class=\"p1\"><span class=\"s1\">hxxp:\/\/www.paehl.com\/open_source\/?download=curl_742_1.zip<\/span><\/li>\n<li class=\"p1\"><span class=\"s1\">hxxp:\/\/dist.torproject.org\/torbrowser\/4.5.1\/tor-win32-0.2.6.7.zip<\/span><\/li>\n<\/ul>\n<p>All downloaded files and artifacts are stored in the following path:<\/p>\n<ul>\n<li class=\"p1\"><span class=\"s1\">C:\\Users\\&lt;username&gt;\\AppData\\Roaming\\<\/span><\/li>\n<\/ul>\n<p class=\"p1\"><span class=\"s1\">After execution, Tox will\u00a0start TOR in SOCKS5 proxy mode with the following command-line parameters:<\/span><\/p>\n<blockquote>\n<p class=\"p1\"><span class=\"s1\">-socks5-hostname 127.0.0.1:9050 &#8211;data \\<\/span><\/p>\n<\/blockquote>\n<p class=\"p1\"><a href=\"https:\/\/securingtomorrow.mcafee.com\/mcafee-labs\/meet-tox-ransomware-for-the-rest-of-us\/attachment\/cc_send-jpg\" rel=\"attachment wp-att-43535\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-43535 size-full\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/CC_send.JPG.jpeg\" alt=\"C&amp;C_send.JPG\" width=\"832\" height=\"681\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/CC_send.JPG.jpeg 832w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/CC_send.JPG-300x246.jpeg 300w\" sizes=\"auto, (max-width: 832px) 100vw, 832px\" \/><\/a><\/p>\n<p class=\"p1\">We don&#8217;t expect Tox to be the last malware to embrace this model. We also anticipate more skilled development and variations in encryption and evasion techniques.<\/p>\n<p class=\"p1\">\n","protected":false},"excerpt":{"rendered":"<p>The packaging of malware and malware-construction kits for cybercrime &#8220;consumers&#8221; has been a long-running trend. Various turnkey kits that cover&#8230;<\/p>\n","protected":false},"author":695,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[442],"tags":[76,338,180],"coauthors":[4136],"class_list":["post-43499","post","type-post","status-publish","format-standard","hentry","category-mcafee-labs","tag-cybercrime","tag-endpoint-protection","tag-malware"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v25.4 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Meet &#039;Tox&#039;: Ransomware for the Rest of Us | McAfee Blog<\/title>\n<meta name=\"description\" content=\"Similar to other threats, ransomware has now appeared in an easy-to-deploy cybercrime kit. The malware is called Tox, and it&#039;s free.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Meet &#039;Tox&#039;: Ransomware for the Rest of Us | McAfee Blog\" \/>\n<meta property=\"og:description\" content=\"Similar to other threats, ransomware has now appeared in an easy-to-deploy cybercrime kit. The malware is called Tox, and it&#039;s free.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/meet-tox-ransomware-for-the-rest-of-us\/\" \/>\n<meta property=\"og:site_name\" content=\"McAfee Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/McAfee\/\" \/>\n<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/McAfee\/\" \/>\n<meta property=\"article:published_time\" content=\"2015-05-24T02:09:02+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-06-03T03:39:02+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/toxlogo.png\" \/>\n\t<meta property=\"og:image:width\" content=\"647\" \/>\n\t<meta property=\"og:image:height\" content=\"239\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"McAfee Labs\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@McAfee_Labs\" \/>\n<meta name=\"twitter:site\" content=\"@McAfee\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"McAfee Labs\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/meet-tox-ransomware-for-the-rest-of-us\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/meet-tox-ransomware-for-the-rest-of-us\/\"},\"author\":{\"name\":\"McAfee Labs\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/86f325fa6532a017d06d6b49a2f3b1ad\"},\"headline\":\"Meet &#8216;Tox&#8217;: Ransomware for the Rest of Us\",\"datePublished\":\"2015-05-24T02:09:02+00:00\",\"dateModified\":\"2025-06-03T03:39:02+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/meet-tox-ransomware-for-the-rest-of-us\/\"},\"wordCount\":462,\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/meet-tox-ransomware-for-the-rest-of-us\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/toxlogo-300x111.png\",\"keywords\":[\"cybercrime\",\"endpoint protection\",\"malware\"],\"articleSection\":[\"McAfee Labs\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/meet-tox-ransomware-for-the-rest-of-us\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/meet-tox-ransomware-for-the-rest-of-us\/\",\"name\":\"Meet 'Tox': Ransomware for the Rest of Us | McAfee Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/meet-tox-ransomware-for-the-rest-of-us\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/meet-tox-ransomware-for-the-rest-of-us\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/toxlogo-300x111.png\",\"datePublished\":\"2015-05-24T02:09:02+00:00\",\"dateModified\":\"2025-06-03T03:39:02+00:00\",\"description\":\"Similar to other threats, ransomware has now appeared in an easy-to-deploy cybercrime kit. The malware is called Tox, and it's free.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/meet-tox-ransomware-for-the-rest-of-us\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/meet-tox-ransomware-for-the-rest-of-us\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/meet-tox-ransomware-for-the-rest-of-us\/#primaryimage\",\"url\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/toxlogo-300x111.png\",\"contentUrl\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/toxlogo-300x111.png\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/meet-tox-ransomware-for-the-rest-of-us\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Blog\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Other Blogs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"McAfee Labs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"Meet &#8216;Tox&#8217;: Ransomware for the Rest of Us\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"name\":\"McAfee Blog\",\"description\":\"Internet Security News\",\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\",\"name\":\"McAfee\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"width\":1286,\"height\":336,\"caption\":\"McAfee\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/McAfee\/\",\"https:\/\/x.com\/McAfee\",\"https:\/\/www.linkedin.com\/company\/mcafee\/\",\"https:\/\/www.youtube.com\/McAfee\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/86f325fa6532a017d06d6b49a2f3b1ad\",\"name\":\"McAfee Labs\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/af947d76ffbef8521094b476cf8050c3\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/07\/Social-Media-PF-Logo-Pic-300x300-2-96x96.jpg\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/07\/Social-Media-PF-Logo-Pic-300x300-2-96x96.jpg\",\"caption\":\"McAfee Labs\"},\"description\":\"McAfee Labs is one of the leading sources for threat research, threat intelligence, and cybersecurity thought leadership. See our blog posts below for more information.\",\"sameAs\":[\"https:\/\/www.linkedin.com\/company\/mcafee\/\",\"https:\/\/www.facebook.com\/McAfee\/\",\"https:\/\/x.com\/McAfee_Labs\"],\"url\":\"https:\/\/www.mcafee.com\/blogs\/author\/mcafee-labs\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Meet 'Tox': Ransomware for the Rest of Us | McAfee Blog","description":"Similar to other threats, ransomware has now appeared in an easy-to-deploy cybercrime kit. The malware is called Tox, and it's free.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"og_locale":"en_US","og_type":"article","og_title":"Meet 'Tox': Ransomware for the Rest of Us | McAfee Blog","og_description":"Similar to other threats, ransomware has now appeared in an easy-to-deploy cybercrime kit. The malware is called Tox, and it's free.","og_url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/meet-tox-ransomware-for-the-rest-of-us\/","og_site_name":"McAfee Blog","article_publisher":"https:\/\/www.facebook.com\/McAfee\/","article_author":"https:\/\/www.facebook.com\/McAfee\/","article_published_time":"2015-05-24T02:09:02+00:00","article_modified_time":"2025-06-03T03:39:02+00:00","og_image":[{"width":647,"height":239,"url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/toxlogo.png","type":"image\/png"}],"author":"McAfee Labs","twitter_card":"summary_large_image","twitter_creator":"@McAfee_Labs","twitter_site":"@McAfee","twitter_misc":{"Written by":"McAfee Labs","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/meet-tox-ransomware-for-the-rest-of-us\/#article","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/meet-tox-ransomware-for-the-rest-of-us\/"},"author":{"name":"McAfee Labs","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/86f325fa6532a017d06d6b49a2f3b1ad"},"headline":"Meet &#8216;Tox&#8217;: Ransomware for the Rest of Us","datePublished":"2015-05-24T02:09:02+00:00","dateModified":"2025-06-03T03:39:02+00:00","mainEntityOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/meet-tox-ransomware-for-the-rest-of-us\/"},"wordCount":462,"publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/meet-tox-ransomware-for-the-rest-of-us\/#primaryimage"},"thumbnailUrl":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/toxlogo-300x111.png","keywords":["cybercrime","endpoint protection","malware"],"articleSection":["McAfee Labs"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/meet-tox-ransomware-for-the-rest-of-us\/","url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/meet-tox-ransomware-for-the-rest-of-us\/","name":"Meet 'Tox': Ransomware for the Rest of Us | McAfee Blog","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/meet-tox-ransomware-for-the-rest-of-us\/#primaryimage"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/meet-tox-ransomware-for-the-rest-of-us\/#primaryimage"},"thumbnailUrl":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/toxlogo-300x111.png","datePublished":"2015-05-24T02:09:02+00:00","dateModified":"2025-06-03T03:39:02+00:00","description":"Similar to other threats, ransomware has now appeared in an easy-to-deploy cybercrime kit. The malware is called Tox, and it's free.","breadcrumb":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/meet-tox-ransomware-for-the-rest-of-us\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/meet-tox-ransomware-for-the-rest-of-us\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/meet-tox-ransomware-for-the-rest-of-us\/#primaryimage","url":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/toxlogo-300x111.png","contentUrl":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/toxlogo-300x111.png"},{"@type":"BreadcrumbList","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/meet-tox-ransomware-for-the-rest-of-us\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https:\/\/www.mcafee.com\/blogs\/"},{"@type":"ListItem","position":2,"name":"Other Blogs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/"},{"@type":"ListItem","position":3,"name":"McAfee Labs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/"},{"@type":"ListItem","position":4,"name":"Meet &#8216;Tox&#8217;: Ransomware for the Rest of Us"}]},{"@type":"WebSite","@id":"https:\/\/www.mcafee.com\/blogs\/#website","url":"https:\/\/www.mcafee.com\/blogs\/","name":"McAfee Blog","description":"Internet Security News","publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.mcafee.com\/blogs\/#organization","name":"McAfee","url":"https:\/\/www.mcafee.com\/blogs\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","width":1286,"height":336,"caption":"McAfee"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/McAfee\/","https:\/\/x.com\/McAfee","https:\/\/www.linkedin.com\/company\/mcafee\/","https:\/\/www.youtube.com\/McAfee"]},{"@type":"Person","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/86f325fa6532a017d06d6b49a2f3b1ad","name":"McAfee Labs","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/af947d76ffbef8521094b476cf8050c3","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/07\/Social-Media-PF-Logo-Pic-300x300-2-96x96.jpg","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/07\/Social-Media-PF-Logo-Pic-300x300-2-96x96.jpg","caption":"McAfee Labs"},"description":"McAfee Labs is one of the leading sources for threat research, threat intelligence, and cybersecurity thought leadership. See our blog posts below for more information.","sameAs":["https:\/\/www.linkedin.com\/company\/mcafee\/","https:\/\/www.facebook.com\/McAfee\/","https:\/\/x.com\/McAfee_Labs"],"url":"https:\/\/www.mcafee.com\/blogs\/author\/mcafee-labs\/"}]}},"_links":{"self":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/43499","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/users\/695"}],"replies":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/comments?post=43499"}],"version-history":[{"count":2,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/43499\/revisions"}],"predecessor-version":[{"id":214974,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/43499\/revisions\/214974"}],"wp:attachment":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/media?parent=43499"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/categories?post=43499"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/tags?post=43499"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/coauthors?post=43499"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}