Spotify Premium Scams on TikTok and Instagram Spread Vidar Infostealer

Key Takeaways

• Cybercriminals are leveraging TikTok and Instagram to distribute the Vidar infostealer through fake “free premium” offers for services like Spotify, Windows, and Microsoft Office.
• The attacks involve highly convincing social media videos that instruct users to execute PowerShell commands or visit malicious download sites.
• The Vidar infostealer targets a wide range of sensitive data, including browser passwords, cryptocurrency wallet details, and 2FA information from Windows devices.
• Victims not only lose data but also face compromised security, as the malware often creates Windows Defender exclusions, leaving systems vulnerable to further attacks.

Cybercriminals have escalated their tactics, transforming popular social media platforms like TikTok and Instagram into sophisticated conduits for malware distribution. A recent campaign deceives users with promises of free Spotify Premium, Windows activation, and Microsoft Office, only to infect their Windows devices with the potent Vidar infostealer.

This strategic shift highlights an evolving threat landscape where attackers craft highly polished, short-form video content that seamlessly integrates with legitimate tech tutorials. These deceptive videos bypass traditional security measures by exploiting user trust and the platforms’ widespread reach, making them a formidable challenge for cybersecurity professionals.

The Rise of Social Media as a Malware Vector

The days of rudimentary phishing emails are largely behind us. Modern cybercriminals are now adept at creating social media content that is virtually indistinguishable from genuine posts. These professionally produced videos are designed to blend into users’ feeds, making it difficult for viewers to discern malicious intent before succumbing to the scam.

Researchers at ReversingLabs have identified two distinct, active campaigns utilizing these short videos to coerce users into executing dangerous PowerShell commands or navigating to malicious download portals. This method allows attackers to disseminate malware to millions of unsuspecting individuals through platforms they regularly engage with.

Analysts at Malwarebytes confirmed this trend in a report shared with Cyber Security News (CSN), noting that similar campaigns have been flagged by other security researchers and national cybersecurity agencies. This underscores a concerning pattern where cybercriminals are effectively leveraging social media algorithms to amplify their attacks with minimal overhead.

Vidar Infostealer: A Deep Dive

At the core of these campaigns is Vidar, a notorious infostealer engineered to clandestinely exfiltrate sensitive data from compromised systems. Upon infiltration, Vidar systematically harvests a comprehensive array of personal information, including saved browser passwords, autofill data, browser cookies, cryptocurrency wallet details, two-factor authentication (2FA) data, and even TOR browser information.

All collected data is subsequently transmitted to attacker-controlled servers, furnishing the perpetrators with a detailed blueprint of the victim’s digital life. This extensive data exfiltration poses significant risks, ranging from direct financial losses to complete account takeovers across multiple services.

Hackers Use Free Spotify Premium Hacks

One of the identified campaigns demonstrates remarkable sophistication. Accounts masquerading as “windows.tips” or “windows.insights” publish videos that mimic authentic tech support content, featuring Windows-style branding and high-quality production. These videos are strategically tagged with Windows and Office-related keywords, ensuring they appear alongside legitimate troubleshooting guides in search results and recommendation feeds.

The tutorials guide viewers through seemingly innocuous steps, such as opening PowerShell—a legitimate Windows administrative tool—and pasting a series of commands. Unbeknownst to the user, these commands silently download and execute the Vidar infostealer in the background. This technique closely resembles what researchers refer to as “ClickFix” attacks, where social engineering tricks users into self-infecting their systems, thereby circumventing conventional security defenses.

Vidar’s Evasion Tricks and Security Risks

Vidar’s threat extends beyond initial data theft. Investigations into similar TikTok-based attack chains reveal that the malicious scripts frequently add exclusions to Windows Defender. This action effectively incapacitates the built-in security tool, leaving the infected device vulnerable to subsequent attacks even after the initial Vidar compromise has been addressed.

The stolen data presents severe long-term risks. Browser cookies can facilitate session hijacking, allowing attackers to access active user sessions without requiring passwords. Compromised cryptocurrency wallet data can lead to immediate and irreversible financial losses. Furthermore, the exfiltration of 2FA data can neutralize an account’s primary layer of defense, making even seemingly secure accounts susceptible to unauthorized access.

What You Should Do

• Download Software from Official Sources: Always obtain software directly from official vendor websites. Avoid third-party download sites or promises of “free” premium versions of paid software.
• Exercise Caution with Unfamiliar Instructions: Be highly skeptical of any online instructions, particularly those on unfamiliar web pages or social media, that direct you to run commands or paste code into administrative tools like PowerShell.
• Verify Downloads: Before executing any downloaded file, verify that its name and size match expectations. Check for digital signatures to confirm the authenticity of the publisher.
• Maintain Robust Anti-Malware Solutions: Ensure a reputable, real-time anti-malware solution is active and regularly updated on all your devices.
• Be Wary of Social Engineering: Recognize that cybercriminals are skilled at creating convincing content. If an offer seems too good to be true, it likely is.
• Enable Multi-Factor Authentication (MFA): While Vidar can steal 2FA data, robust MFA solutions, especially hardware-based keys, offer superior protection.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.