Attackers are leveraging TikTok videos to distribute malware by masquerading as free software activations. The campaign uses social engineering to convince users to run malicious PowerShell scripts that download additional payloads, including the AuroStealer information stealer. Persistence is established via scheduled tasks, and one payload uses a self-compiling technique to inject shellcode directly into memory, evading detection. Multiple TikTok videos target various software products, employing the ClickFix technique to increase user trust. This threat exploits user interaction and social engineering on a popular platform, posing a medium risk due to its potential to compromise confidentiality and integrity. European organizations with users active on TikTok and those using targeted software products are at risk. Mitigations include user education, PowerShell execution restrictions, monitoring scheduled tasks, and blocking malicious domains. Countries with high TikTok usage and significant software user bases, such as Germany, France, and the UK, are more likely to be affected.
