ClickFix Social Engineering Attacks Using TikTok Videos to Deliver Information-Stealing Malware

Threat actors have begun exploiting TikTok as a platform to distribute information-stealing malware through a new social engineering technique known as ClickFix. Attackers create TikTok videos that masquerade as tutorials for obtaining free software licenses, such as Adobe Photoshop or Microsoft Windows, enticing users with the promise of bypassing legitimate licensing requirements. These videos instruct viewers to execute specific commands in PowerShell with administrative privileges, a step that ultimately leads to the download and execution of malicious payloads. Security consultant Xavier Mertens, writing for the SANS Internet Storm Center, identified several live TikTok videos promoting these scams, some of which had garnered significant engagement from users. The primary malware delivered in these campaigns is AuroStealer, also referred to as Aura Stealer, a Trojan designed to exfiltrate credentials, system information, and potentially data from browser extensions and two-factor authentication tools. The ClickFix technique is particularly insidious because it circumvents traditional anti-phishing defenses by convincing users to take direct, risky actions on their own systems. ZDNET’s investigation revealed a surprising number of active scam videos on TikTok, with attackers frequently updating their content to evade detection. The social engineering aspect of ClickFix relies on the perceived legitimacy and popularity of TikTok influencers, making the scam more convincing to unsuspecting users. Once the PowerShell command is executed, the victim’s system downloads 'Updater.exe,' which is the malicious payload, and may also execute additional shellcode in memory to further compromise the device. The impact of these attacks can be severe, as AuroStealer is capable of harvesting sensitive information from a wide range of applications and browsers, potentially leading to account takeovers and further compromise. Security experts warn that the use of mainstream social media platforms like TikTok for malware distribution represents an evolution in threat actor tactics, leveraging the trust and reach of these networks. The attacks highlight the need for increased user awareness and skepticism regarding software activation guides and similar content on social media. Organizations are advised to educate employees about the risks of following unsolicited technical instructions from unverified online sources. The incident underscores the importance of monitoring emerging social engineering trends and adapting security controls to address new delivery vectors. Both references emphasize the role of TikTok as a delivery mechanism and the sophistication of the ClickFix technique in bypassing conventional security measures. The campaign demonstrates how attackers are constantly seeking new communication channels to reach potential victims and distribute malware effectively. Security professionals recommend implementing technical controls to restrict the execution of unauthorized scripts and monitoring for suspicious PowerShell activity. The ongoing prevalence of these scams on TikTok suggests that threat actors will continue to exploit popular social platforms for malicious purposes unless proactive measures are taken.