TikTok Videos Promoting Malware Installation

Attackers are leveraging TikTok videos to distribute malware by masquerading as free software activations. The campaign uses social engineering to convince users to run malicious PowerShell scripts that download additional payloads, including the AuroStealer information stealer. Persistence is established via scheduled tasks, and one payload uses a self-compiling technique to inject shellcode directly into memory, evading detection. Multiple TikTok videos target various software products, employing the ClickFix technique to increase user trust. This threat exploits user interaction and social engineering on a popular platform, posing a medium risk due to its potential to compromise confidentiality and integrity. European organizations with users active on TikTok and those using targeted software products are at risk. Mitigations include user education, PowerShell execution restrictions, monitoring scheduled tasks, and blocking malicious domains. Countries with high TikTok usage and significant software user bases, such as Germany, France, and the UK, are more likely to be affected.

• Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFixMalware2026-09-29
• third-party.com Placeholder Domain Now Serves ClickFixCampaign2026-09-24
• Konni Hackers Target Ukraine With Malicious LNK Files and VelvetCake PowerShell MalwareMalware2026-09-24
• Variola: From ClickFix to a Modular ImplantMalware2026-10-16
• Fake Calendly "Meta Careers" pages steal Facebook and Google loginsCampaign2026-10-14