Menu

  • Alerts
  • Incidents
  • News
  • APTs
  • Cyber Decoded
  • Cyber Hygiene
  • Cyber Review
  • Cyber Tips
  • Definitions
  • Malware
  • Threat Actors
  • Tutorials

Useful Tools

  • Password generator
  • Report an incident
  • Report to authorities
No Result
View All Result
CTF Hack Havoc
CyberMaterial
  • Education
    • Cyber Decoded
    • Definitions
  • Information
    • Alerts
    • Incidents
    • News
  • Insights
    • Cyber Hygiene
    • Cyber Review
    • Tips
    • Tutorials
  • Support
    • Contact Us
    • Report an incident
  • About
    • About Us
    • Advertise with us
Get Help
Hall of Hacks
  • Education
    • Cyber Decoded
    • Definitions
  • Information
    • Alerts
    • Incidents
    • News
  • Insights
    • Cyber Hygiene
    • Cyber Review
    • Tips
    • Tutorials
  • Support
    • Contact Us
    • Report an incident
  • About
    • About Us
    • Advertise with us
Get Help
No Result
View All Result
Hall of Hacks
CyberMaterial
No Result
View All Result
Home Alerts

TikTok Videos Spread Vidar StealC Malware

May 23, 2025
Reading Time: 3 mins read
in Alerts
TikTok Videos Spread Vidar StealC Malware

Cybercriminals are now using TikTok videos to trick users into installing dangerous malware. These sophisticated ClickFix attacks distribute both Vidar and StealC information-stealing malware variants. Trend Micro security researchers recently discovered this widespread social engineering phishing campaign. The threat actors involved use videos that are very likely generated using AI tools. These videos instruct unsuspecting viewers to run specific PowerShell commands on their computers. The commands are cleverly disguised as steps to activate Windows or Microsoft Office. They also falsely claim to unlock premium features in legitimate software like CapCut. TikTok’s algorithmic reach significantly increases the likelihood of widespread victim exposure to these scams. One such malicious video reached over half a million views with many likes.

In the videos attackers prompt viewers to run a specific PowerShell download execution command.

This command instead downloads and then executes a malicious remote script from a server. This script then secretly installs either Vidar or StealC information-stealing malware onto systems. The malware is launched as a completely hidden process with highly elevated system permissions. Once deployed the Vidar malware can take many desktop screenshots and steal credentials. It also targets credit cards browser cookies cryptocurrency wallets and Authy 2FA authenticator databases. StealC malware can also harvest a wide range of sensitive information from infected computers. It specifically targets data from dozens of web browsers and also many cryptocurrency wallets. After initial compromise a second script adds a registry key for automatic startup. This action ensures the malware achieves long-term persistence on the victim’s now compromised system.

The ClickFix tactic employs fake system errors or various online verification system prompts. For example it might use deceptive CAPTCHA prompts to trick its potential targets. It aims to make users run malicious scripts to download and install malware. While generally targeting Windows users ClickFix also attacks macOS and Linux computer users. Even sophisticated state-sponsored threat groups have used very similar tactics in their attacks. This is not the first time TikTok videos were used to push malware. A previous ‘Invisible Challenge’ on TikTok infected thousands with the WASP Stealer malware. This new campaign cleverly uses faceless videos possibly AI-generated to provide malware instructions. This approach leaves no malicious code directly on the TikTok platform for easy detection.

The infection process begins when users execute the PowerShell command shown in TikTok videos.

This innocuous-looking command downloads and then immediately runs a harmful remote script. Upon execution the script creates hidden directories and adds Windows Defender exclusion list entries. This is a sophisticated evasion technique helping malware to successfully avoid standard antivirus detection. The malware then proceeds to download additional payloads including Vidar and StealC infostealers. Vidar for instance uses Steam profiles and Telegram channels as Dead Drop Resolvers. This technique effectively hides its actual command-and-control (C2) server infrastructure from researchers. The campaign effectively blends social engineering with more advanced technical exploitation of user trust. Users should maintain healthy skepticism towards any unsolicited technical instructions found on social media.

Reference:

  • TikTok Videos Spread Vidar and StealC Stealer Malware in ClickFix Attacks
Tags: Cyber AlertsCyber Alerts 2025CyberattackCybersecurityMay 2025
ADVERTISEMENT

Related Posts

Wing FTP Server RCE Flaw Exploited

WinRAR Zero-Day Exploit $80K on Dark Web

July 14, 2025
Wing FTP Server RCE Flaw Exploited

Google Gemini Flaw Hijacks Email Summaries

July 14, 2025
Wing FTP Server RCE Flaw Exploited

Wing FTP Server RCE Flaw Exploited

July 14, 2025
Fake Firms Push Malware on Crypto Users

Fake Sites Push Investment Scams

July 11, 2025
Fake Firms Push Malware on Crypto Users

Severe WordPress Flaw 200K Sites at Risk

July 11, 2025
Fake Firms Push Malware on Crypto Users

Fake Firms Push Malware on Crypto Users

July 11, 2025

Latest Alerts

WinRAR Zero-Day Exploit $80K on Dark Web

Google Gemini Flaw Hijacks Email Summaries

Wing FTP Server RCE Flaw Exploited

Fake Sites Push Investment Scams

Fake Firms Push Malware on Crypto Users

Severe WordPress Flaw 200K Sites at Risk

Subscribe to our newsletter

    Latest Incidents

    Supermarket Cyberattack Prompts Warning

    China Hacker Suspected in DC Law Firm Breach

    nius.de Cyberattack Leaks User Data

    Microsoft’s Outlook Long Outage

    Avantic Lab Affected By Ransomware

    $40M+ Stolen from GMX Crypto Platform

    CyberMaterial Logo
    • About Us
    • Contact Us
    • Jobs
    • Legal and Privacy Policy
    • Site Map

    © 2025 | CyberMaterial | All rights reserved

    Welcome Back!

    Login to your account below

    Forgotten Password?

    Retrieve your password

    Please enter your username or email address to reset your password.

    Log In

    Add New Playlist

    No Result
    View All Result
    • Alerts
    • Incidents
    • News
    • Cyber Decoded
    • Cyber Hygiene
    • Cyber Review
    • Definitions
    • Malware
    • Cyber Tips
    • Tutorials
    • Advanced Persistent Threats
    • Threat Actors
    • Report an incident
    • Password Generator
    • About Us
    • Contact Us
    • Advertise with us

    Copyright © 2025 CyberMaterial