Become a TechRadar Insider
- TikTok and Instagram Reels now being used to target victims
- "Free" Spotify, Microsoft, Adobe subscriptions targeting cash-strapped users
- Social engineering is still the top vector, but basic account security measures do a lot of the heavy lifting
A new report from ReversingLabs is warning doomscrollers of videos spreading across short-form platforms like TikTok and Instagram Reels infecting users with password-stealing malware.
The videos typically promise free access to subscriptions like Spotify Premium, Windows, Office and Adobe – an instant, telltale sign that things might not be as they seem.
Instead of receiving phishing emails, victims are instructed to open command-line tools like PowerShell, then paste and run the command shown in the video.
Watch out for this info stealing malware
When they run the command, it triggers a piece of malware to be downloaded and installed to a victim's computer. Vidar, the infostealer, targets usernames, passwords, cookies, session tokens, cryptocurrency wallet data, personal files and documents, and other sensitive information.
But more importantly, it marks a significant change – previously, email phishing campaigns have been extremely popular for gaining access to victims' credentials, with a simple click of a link leading to potential disaster. This newer method relies on victims physically inputting commands into a tool, which requires more patience.
Ultimately, the attack exploits current economic strains and the fact that consumers are looking out for cheap and free alternatives to popular subscriptions.
"This kind of social engineering is an easy way for threat actors to drive traffic off social media and onto an attacker-controlled malicious website," the researchers wrote.
Regardless, the overarching theme is that social engineering remains the clearest path for attackers to reach victims, and that's good news because there are many basic principles could-be victims can follow, like using multi-factor authentication to secure accounts.
Being wary of suspiciously cheap or free products/services and only downloading software from official vendors would also help in this instance.
Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.
