{"id":1526,"date":"2025-05-23T12:50:34","date_gmt":"2025-05-23T09:50:34","guid":{"rendered":"https:\/\/trustcrypt.com\/tiktok-videos-now-facilitate-infostealer-malware-distribution-in-clickfix-campaigns\/"},"modified":"2025-05-23T12:50:34","modified_gmt":"2025-05-23T09:50:34","slug":"tiktok-videos-now-facilitate-infostealer-malware-distribution-in-clickfix-campaigns","status":"publish","type":"post","link":"https:\/\/trustcrypt.com\/ar\/tiktok-videos-now-facilitate-infostealer-malware-distribution-in-clickfix-campaigns\/","title":{"rendered":"TikTok Videos Now Facilitate Infostealer Malware Distribution in ClickFix Campaigns"},"content":{"rendered":"

\"TikTok\"<\/p>\n

Recent investigations have revealed a troubling trend where cybercriminals are exploiting TikTok videos as a vehicle to distribute Vidar and StealC information-stealing malware through ClickFix attacks.<\/p>\n

According to insights from Trend Micro, the perpetrators of this social engineering scheme are utilizing videos, likely generated via artificial intelligence, which urge viewers to execute commands that supposedly activate Windows, Microsoft Office, and premium features of software such as CapCut and Spotify.<\/p>\n

\u201cThis attack involves videos that instruct users to run PowerShell commands disguised as software activation procedures. TikTok’s broad algorithmic reach significantly amplifies the potential for widespread victimization, with certain videos garnering over half a million views,\u201d Trend Micro highlighted. <\/p>\n

These videos exhibit striking similarities with only minor variations in camera angles and the download links utilized by PowerShell to retrieve the malicious payload, suggesting the use of automation in their creation. Additionally, the instructional voiceover appears to be AI-generated, further indicating the involvement of AI tools in producing this content.<\/p>\n

One notable video purporting to enhance users’ Spotify experience has amassed nearly 500,000 views, received over 20,000 likes, and generated upwards of 100 comments.<\/p>\n

\n
\"TikTok
TikTok ClickFix video (Trend Micro)<\/em><\/figcaption><\/figure>\n<\/div>\n

In these videos, attackers encourage viewers to execute a PowerShell command that downloads and runs a remote script from hxxps:\/\/allaivo[.]me\/spotify<\/em>, leading to the installation of Vidar or StealC malware, which is subsequently launched as a hidden process with elevated permissions.<\/p>\n

Upon activation, Vidar<\/a> has the capability to capture desktop screenshots and exfiltrate sensitive data including login credentials, credit card information, cookies, cryptocurrency wallets, text files, and Authy 2FA databases.<\/p>\n

Stealc<\/a> is similarly equipped to gather a wide array of sensitive information from infected machines, specifically targeting numerous web browsers and cryptocurrency wallets.<\/p>\n

Once the device is compromised, the malicious script fetches a second PowerShell payload from hxxps:\/\/amssh[.]co\/script[.]ps1<\/em>, which introduces a registry key that ensures the malware executes on system startup.<\/p>\n

\n
\"Attack
Attack flow (Trend Micro)<\/em><\/figcaption><\/figure>\n<\/div>\n

Definition of ClickFix<\/h2>\n

blank” rel=”nofollow noopener”>ClickFix<\/a> is a malicious tactic wherein attackers employ fabricated error messages or verification prompts, such as blank” rel=”nofollow noopener”>CAPTCHA prompts<\/a>, to lure unsuspecting victims into executing harmful scripts that install malware on their devices.<\/p>\n

While primarily aimed at blank” rel=”nofollow noopener”>Windows<\/a> blank” rel=”nofollow noopener”>users<\/a> through PowerShell scripts, ClickFix has increasingly been employed against blank” rel=”nofollow noopener”>macOS<\/a> and blank” rel=”nofollow noopener”>Linux<\/a> users as well.<\/p>\n

State-sponsored advanced persistent threat (APT) groups have similarly executed these types of attacks. Notable threats such as APT28 and ColdRiver from Russia, Kimsuky from North Korea, and MuddyWater from Iran have all employed similar tactics in recent espionage campaigns.<\/p>\n

This latest TikTok-related incident is not an isolated case; there have been previous instances where cybercriminals used the platform to disseminate malware. For example, a trending TikTok challenge known as the ‘Invisible Challenge’ resulted in the infection of thousands of users through a malicious application that delivered WASP Stealer (Discord Token Grabber) malware<\/a>.<\/p>\n

This malware spread through videos that rapidly obtained over a million views shortly after release and could compromise Discord accounts, passwords, credit card details, and cryptocurrency wallet information.<\/p>\n

In recent years, there has also been a significant increase in scams circulating on TikTok, including fake cryptocurrency giveaways, frequently leveraging celebrities such as Elon Musk, Tesla, or SpaceX as bait.<\/p>\n","protected":false},"excerpt":{"rendered":"

Recent investigations have revealed a troubling trend where cybercriminals are exploiting TikTok videos as a vehicle to distribute Vidar and…<\/p>\n","protected":false},"author":1,"featured_media":1527,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"Default","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[28],"tags":[54,265,626],"class_list":["post-1526","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-malware","tag-powershell","tag-tiktok"],"acf":[],"yoast_head":"\nTikTok Videos Now Facilitate Infostealer Malware Distribution in ClickFix Campaigns - Trustcrypt<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/trustcrypt.com\/ar\/tiktok-videos-now-facilitate-infostealer-malware-distribution-in-clickfix-campaigns\/\" \/>\n<meta property=\"og:locale\" content=\"ar_AR\" \/>\n<meta property=\"og:locale:alternate\" content=\"en_GB\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"TikTok Videos Now Facilitate Infostealer Malware Distribution in ClickFix Campaigns\" \/>\n<meta property=\"og:description\" content=\"Recent investigations have revealed a troubling trend where cybercriminals are exploiting TikTok videos as a vehicle to distribute Vidar and...\" \/>\n<meta property=\"og:url\" content=\"https:\/\/trustcrypt.com\/ar\/tiktok-videos-now-facilitate-infostealer-malware-distribution-in-clickfix-campaigns\/\" \/>\n<meta property=\"og:site_name\" content=\"Trustcrypt\" \/>\n<meta property=\"article:published_time\" content=\"2025-05-23T09:50:34+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/trustcrypt.com\/wp-content\/uploads\/2025\/05\/tiktok-videos-now-facilitate-infostealer-malware-distribution-in-clickfix-campaigns.jpg\" \/>\n<meta name=\"author\" content=\"Trustscrypt\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u0643\u064f\u062a\u0628 \u0628\u0648\u0627\u0633\u0637\u0629\" \/>\n\t<meta name=\"twitter:data1\" content=\"Trustscrypt\" \/>\n\t<meta name=\"twitter:label2\" content=\"\u0648\u0642\u062a \u0627\u0644\u0642\u0631\u0627\u0621\u0629 \u0627\u0644\u0645\u064f\u0642\u062f\u0651\u0631\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 \u062f\u0642\u0627\u0626\u0642\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/trustcrypt.com\/tiktok-videos-now-facilitate-infostealer-malware-distribution-in-clickfix-campaigns\/\",\"url\":\"https:\/\/trustcrypt.com\/tiktok-videos-now-facilitate-infostealer-malware-distribution-in-clickfix-campaigns\/\",\"name\":\"TikTok Videos Now Facilitate Infostealer Malware Distribution in ClickFix Campaigns\",\"isPartOf\":{\"@id\":\"https:\/\/trustcrypt.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/trustcrypt.com\/tiktok-videos-now-facilitate-infostealer-malware-distribution-in-clickfix-campaigns\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/trustcrypt.com\/tiktok-videos-now-facilitate-infostealer-malware-distribution-in-clickfix-campaigns\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/trustcrypt.com\/wp-content\/uploads\/2025\/05\/tiktok-videos-now-facilitate-infostealer-malware-distribution-in-clickfix-campaigns.webp\",\"datePublished\":\"2025-05-23T09:50:34+00:00\",\"author\":{\"@id\":\"https:\/\/trustcrypt.com\/#\/schema\/person\/469b1cf97b9f7ea4e4d7fa31689dfa9f\"},\"inLanguage\":\"ar\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/trustcrypt.com\/tiktok-videos-now-facilitate-infostealer-malware-distribution-in-clickfix-campaigns\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"ar\",\"@id\":\"https:\/\/trustcrypt.com\/tiktok-videos-now-facilitate-infostealer-malware-distribution-in-clickfix-campaigns\/#primaryimage\",\"url\":\"https:\/\/trustcrypt.com\/wp-content\/uploads\/2025\/05\/tiktok-videos-now-facilitate-infostealer-malware-distribution-in-clickfix-campaigns.webp\",\"contentUrl\":\"https:\/\/trustcrypt.com\/wp-content\/uploads\/2025\/05\/tiktok-videos-now-facilitate-infostealer-malware-distribution-in-clickfix-campaigns.webp\",\"width\":1792,\"height\":1024,\"caption\":\"TikTok Videos Now Facilitate Infostealer Malware Distribution in ClickFix Campaigns\"},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/trustcrypt.com\/#website\",\"url\":\"https:\/\/trustcrypt.com\/\",\"name\":\"Trustcrypt\",\"description\":\"\u0627\u0644\u0623\u0645\u0646 \u0647\u0648 \u0627\u0633\u0645\u0646\u0627 \u0627\u0644\u062b\u0627\u0646\u064a\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/trustcrypt.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"ar\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/trustcrypt.com\/#\/schema\/person\/469b1cf97b9f7ea4e4d7fa31689dfa9f\",\"name\":\"Trustscrypt\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"ar\",\"@id\":\"https:\/\/trustcrypt.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/4c36ff3376565a0f4981e9397667feb08d5e09acacce32a52ea4a3f628e03692?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/4c36ff3376565a0f4981e9397667feb08d5e09acacce32a52ea4a3f628e03692?s=96&d=mm&r=g\",\"caption\":\"Trustscrypt\"},\"sameAs\":[\"http:\/\/trustcrypt.com\"],\"url\":\"https:\/\/trustcrypt.com\/ar\/author\/trustscrypt\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"TikTok Videos Now Facilitate Infostealer Malware Distribution in ClickFix Campaigns - Trustcrypt","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/trustcrypt.com\/ar\/tiktok-videos-now-facilitate-infostealer-malware-distribution-in-clickfix-campaigns\/","og_locale":"ar_AR","og_type":"article","og_title":"[:en]TikTok Videos Now Facilitate Infostealer Malware Distribution in ClickFix Campaigns[:] - Trustcrypt","og_description":"Recent investigations have revealed a troubling trend where cybercriminals are exploiting TikTok videos as a vehicle to distribute Vidar and...","og_url":"https:\/\/trustcrypt.com\/ar\/tiktok-videos-now-facilitate-infostealer-malware-distribution-in-clickfix-campaigns\/","og_site_name":"Trustcrypt","article_published_time":"2025-05-23T09:50:34+00:00","og_image":[{"url":"https:\/\/trustcrypt.com\/wp-content\/uploads\/2025\/05\/tiktok-videos-now-facilitate-infostealer-malware-distribution-in-clickfix-campaigns.jpg","type":"","width":"","height":""}],"author":"Trustscrypt","twitter_card":"summary_large_image","twitter_misc":{"\u0643\u064f\u062a\u0628 \u0628\u0648\u0627\u0633\u0637\u0629":"Trustscrypt","\u0648\u0642\u062a \u0627\u0644\u0642\u0631\u0627\u0621\u0629 \u0627\u0644\u0645\u064f\u0642\u062f\u0651\u0631":"3 \u062f\u0642\u0627\u0626\u0642"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/trustcrypt.com\/tiktok-videos-now-facilitate-infostealer-malware-distribution-in-clickfix-campaigns\/","url":"https:\/\/trustcrypt.com\/tiktok-videos-now-facilitate-infostealer-malware-distribution-in-clickfix-campaigns\/","name":"TikTok Videos Now Facilitate Infostealer Malware Distribution in ClickFix Campaigns","isPartOf":{"@id":"https:\/\/trustcrypt.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/trustcrypt.com\/tiktok-videos-now-facilitate-infostealer-malware-distribution-in-clickfix-campaigns\/#primaryimage"},"image":{"@id":"https:\/\/trustcrypt.com\/tiktok-videos-now-facilitate-infostealer-malware-distribution-in-clickfix-campaigns\/#primaryimage"},"thumbnailUrl":"https:\/\/trustcrypt.com\/wp-content\/uploads\/2025\/05\/tiktok-videos-now-facilitate-infostealer-malware-distribution-in-clickfix-campaigns.webp","datePublished":"2025-05-23T09:50:34+00:00","author":{"@id":"https:\/\/trustcrypt.com\/#\/schema\/person\/469b1cf97b9f7ea4e4d7fa31689dfa9f"},"inLanguage":"ar","potentialAction":[{"@type":"ReadAction","target":["https:\/\/trustcrypt.com\/tiktok-videos-now-facilitate-infostealer-malware-distribution-in-clickfix-campaigns\/"]}]},{"@type":"ImageObject","inLanguage":"ar","@id":"https:\/\/trustcrypt.com\/tiktok-videos-now-facilitate-infostealer-malware-distribution-in-clickfix-campaigns\/#primaryimage","url":"https:\/\/trustcrypt.com\/wp-content\/uploads\/2025\/05\/tiktok-videos-now-facilitate-infostealer-malware-distribution-in-clickfix-campaigns.webp","contentUrl":"https:\/\/trustcrypt.com\/wp-content\/uploads\/2025\/05\/tiktok-videos-now-facilitate-infostealer-malware-distribution-in-clickfix-campaigns.webp","width":1792,"height":1024,"caption":"TikTok Videos Now Facilitate Infostealer Malware Distribution in ClickFix Campaigns"},{"@type":"WebSite","@id":"https:\/\/trustcrypt.com\/#website","url":"https:\/\/trustcrypt.com\/","name":"Trustcrypt","description":"\u0627\u0644\u0623\u0645\u0646 \u0647\u0648 \u0627\u0633\u0645\u0646\u0627 \u0627\u0644\u062b\u0627\u0646\u064a","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/trustcrypt.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"ar"},{"@type":"Person","@id":"https:\/\/trustcrypt.com\/#\/schema\/person\/469b1cf97b9f7ea4e4d7fa31689dfa9f","name":"Trustscrypt","image":{"@type":"ImageObject","inLanguage":"ar","@id":"https:\/\/trustcrypt.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/4c36ff3376565a0f4981e9397667feb08d5e09acacce32a52ea4a3f628e03692?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/4c36ff3376565a0f4981e9397667feb08d5e09acacce32a52ea4a3f628e03692?s=96&d=mm&r=g","caption":"Trustscrypt"},"sameAs":["http:\/\/trustcrypt.com"],"url":"https:\/\/trustcrypt.com\/ar\/author\/trustscrypt\/"}]}},"_links":{"self":[{"href":"https:\/\/trustcrypt.com\/ar\/wp-json\/wp\/v2\/posts\/1526","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/trustcrypt.com\/ar\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/trustcrypt.com\/ar\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/trustcrypt.com\/ar\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/trustcrypt.com\/ar\/wp-json\/wp\/v2\/comments?post=1526"}],"version-history":[{"count":0,"href":"https:\/\/trustcrypt.com\/ar\/wp-json\/wp\/v2\/posts\/1526\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/trustcrypt.com\/ar\/wp-json\/wp\/v2\/media\/1527"}],"wp:attachment":[{"href":"https:\/\/trustcrypt.com\/ar\/wp-json\/wp\/v2\/media?parent=1526"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/trustcrypt.com\/ar\/wp-json\/wp\/v2\/categories?post=1526"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/trustcrypt.com\/ar\/wp-json\/wp\/v2\/tags?post=1526"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}