AI-Generated TikTok Videos Used in Malware Social Engineering Campaign
Cybercriminals used AI-generated videos on TikTok to trick users into downloading malware by posing as software tutorials, instructing victims to execute malicious PowerShell commands under the pretense of activating premium features. Trend Micro researchers identified the campaign, which delivered infostealing malware including Vidar and StealC, and TikTok subsequently deactivated the associated accounts.
What happened
Cybercriminals posted AI-generated videos on TikTok that instructed users to execute PowerShell commands under the guise of activating software or premium features.
The videos promised free versions of Windows and Microsoft Office software or access to premium features in apps like CapCut and Spotify, disguising malicious commands as software activation steps.
The malware campaigns delivered infostealing malware including Vidar and StealC through verbal instructions in the videos, with many videos reaching hundreds of thousands of views.
Reported impact
Users who followed the video instructions unknowingly executed malicious PowerShell commands that injected malware into their systems.
The campaign exploited social engineering within the video content itself rather than through detectable code, making it harder for security solutions to detect and block.
Index analysis
The use of AI-generated videos enabled attackers to create numerous convincing tutorial-style videos at scale that mimicked legitimate software activation processes.
The malware delivery occurred entirely through visual and aural instruction rather than malicious code on the platform, allowing the campaign to evade existing detection mechanisms.
Governance controls
TikTok deactivated the accounts associated with the campaign after researchers identified the threat.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.