Researchers Detail TikTok and Instagram Reels Phishing Campaigns
Summary
ReversingLabs describes two short-form video phishing campaigns offering free premium software. One fake Spotify tutorial led to a Vidarstealer download; researchers could not confirm a payload from the second campaign’s lure sites.
Key points
- Researchers observed two campaigns using TikTok and Instagram Reels videos to lure users with free premium software.
- One fake Spotify Premium tutorial instructed viewers to run a PowerShell command that downloaded build.exe from msget[.]run; ReversingLabs identified the executable as Vidarstealer.
- The other campaign used engagement bait and replies or profile links to direct users to download pages and survey flows.
- Researchers could not complete the surveys or confirm that the second campaign delivered a Spotify installer or other payload.
- Some associated sites were taken down or inactive, but the researchers said accounts and tactics could be recreated.
- The article recommends auditing installation permissions and keeping phishing-awareness training current.
Article Details
- Attack Vectors
- TikTok and Instagram Reels videos used phishing lures promising free premium software and directing viewers to secondary websites.
- Fake tutorials instructed users to run PowerShell commands that downloaded scripts or malware; the Spotify Premium lure delivered build.exe, identified as Vidarstealer.
- Engagement-bait videos used comments, replies, profile links, or follow-up tutorials to direct interested viewers to lure and download sites.
- Defensive Notes
- Regularly audit installation permissions and ensure users understand what they install.
- Keep phishing training current and include social media advice and video-based lures.
- Encourage users to report suspicious social media advice and accounts.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | d4ug[.]site | Campaign lure site offering purported premium software; researchers analyzed it in a sandbox. |
| DOMAIN | maxapk[.]xyz | Lure site advertising free software; identified as one of the campaign's malicious sites. |
| DOMAIN | msget[.]run | Attacker-used download domain serving the executable identified as Vidarstealer. |
| DOMAIN | pluginchad[.]xyz | Lure site advertising free software; identified as one of the campaign's malicious sites. |
| DOMAIN | slmgr[.]sh | Listed as an associated domain in the social-media lure campaign. |
| SHA256 | 03bbc4fa1fd784276da135ab62fef85aaddea66e6eb176d7e59c3398f818b153 | SHA-256 hash of the build.exe sample identified as Vidarstealer. |
MITRE ATT&CK
T1059.001 · PowerShellThe fake Spotify Premium tutorial instructed users to open PowerShell and execute a command.T1105 · Ingress Tool TransferThe instructed PowerShell command retrieved scripts or malware from a remote site.T1204 · User ExecutionVictims were persuaded to follow tutorial instructions, run commands, and download files themselves.T1566.002 · Spearphishing LinkSocial-media videos and account descriptions directed viewers to external lure sites hosting downloads or tutorials.T1585 · Establish AccountsThe campaigns used multiple near-identical social-media accounts to distribute lures.
Malware
Products
Instagram ReelsReversingLabs documented two short-form video phishing campaigns on TikTok and Instagram Reels that lure users with promises of free premium software and then redirect them to attacker-controlled sites.Spotify PremiumOne campaign delivers Vidarstealer through a fake Spotify Premium tutorial, while the other uses engagement bait and comment replies to push victims toward dubious download pages.TikTokReversingLabs documented two short-form video phishing campaigns on TikTok and Instagram Reels that lure users with promises of free premium software and then redirect them to attacker-controlled sites.