Video Scams Steal Your Passwords!

New malware distribution tactics are emerging on short-form video platforms like TikTok and Instagram Reels. Threat actors are posting videos that promise free access to sought-after subscriptions such as Spotify Premium, Windows, Office, and Adobe products. These enticing offers prey on consumers seeking cost-saving alternatives amid economic strains.

Instead of traditional phishing links, these scams direct victims to execute commands within tools like PowerShell. Running these commands triggers the download and installation of the Vidar infostealer. This sophisticated malware is designed to harvest a wide range of sensitive data, including usernames, passwords, cookies, session tokens, cryptocurrency wallet details, and personal documents.

While social engineering remains a primary attack vector, this shift towards user-initiated command execution represents a more involved, though effective, method for attackers. Basic security measures, such as multi-factor authentication and downloading software only from official sources, can significantly mitigate these risks, alongside general skepticism towards suspiciously free or cheap offers.