TikTok Videos Weaponized to Deliver Self-Compiling PowerShell Malware
Recent findings reveal that attackers are leveraging TikTok's extensive reach to distribute malware through videos. A notable example includes a TikTok video, liked over 500 times, where an attacker masquerades as a provider of a free Photoshop…
Recent findings reveal that attackers are leveraging TikTok's extensive reach to distribute malware through videos. A notable example includes a TikTok video, liked over 500 times, where an attacker masquerades as a provider of a free Photoshop activation tool. Users are instructed to run the following PowerShell command:
This command utilizes Invoke-Expression ( iex ) to execute a script obtained via Invoke-RestMethod ( irm ) from a malicious source.
Security researchers have identified a campaign in which threat actors disguise themselves as Photoshop activators in TikTok clips, prompting users to execute PowerShell one-liners that download and run malicious code.
The attack methodology resembles the ClickFix social-engineering scenario, where users are similarly tricked into executing code, leading to malware installation.
Upon accessing the provided link, victims receive a PowerShell payload (SHA256: 6D897B5661AA438A96AC8695C54B7C4F3A1FBF1B628C8D2011E50864860C6B23) with a VirusTotal detection rate of 17/63, indicating its relative novelty.
Once executed, the initial script connects to https://file-epq.pages.dev/updater.exe to download the next stage, Updater.exe (SHA256: 58b11b4dc81d0b005b7d5ecae0fb6ddb3c31ad0e7a9abf9a7638169c51356fd8).
Analysis indicates that this binary is AuroStealer, a credential-harvesting trojan targeting saved browser passwords and cryptocurrency wallets.
Recent findings reveal that attackers are leveraging TikTok's extensive reach to distribute malware through videos.
To maintain persistence, the PowerShell script selects a task name from a list of legitimate update tasks, such as AdobeUpdateTask or WindowsUpdateCheck , creating a scheduled task that runs PowerShell with hidden window style and bypasses execution policy, ensuring Updater.exe runs at user logon without detection.
On-The-Fly Compilation and In-Memory Execution
Following the AuroStealer stage, a further payload named source.exe (SHA256: db57e4a73d3cb90b53a0b1401cb47c41c1d6704a26983248897edcc13a367011) is retrieved and executed.
This binary employs an advanced self-compiling malware technique, invoking the .NET compiler csc.exe to compile source code stored in a temporary .cmdline file.
The compiled class includes P/Invoke declarations for VirtualAlloc , CreateThread , and WaitForSingleObject , allowing it to allocate memory, inject shellcode directly into the process, and execute the payload entirely in-memory.
Such on-demand compilation complicates static analysis and detection, as the final malicious code exists only in ephemeral memory.
Additional TikTok videos from the same campaign have been identified, using different software lures such as "Activate Office" or "Unlock Windows," indicating a broadening of social engineering tactics:
hxxps://vm.tiktok.com/ZGdaC7EQY/ hxxps://vm.tiktok.com/ZGdaX8jVq/
This campaign highlights the evolving tactics of cybercriminals, exploiting short-form video platforms to deliver self-compiling, in-memory malware via PowerShell.
Users are advised against running terminal commands from unverified sources, and platforms should consider alerting viewers when instructions involve potentially dangerous operations.
As attackers continue to innovate with new distribution channels and anti-analysis techniques, security awareness and robust endpoint defenses remain critical in countering these emerging threats.
Based on reporting by GBHackers.