Fake Windows and Office Activation Videos Spread Infostealers on TikTok and Instagram

Short-form video platforms such as TikTok and Instagram Reels have become an increasingly effective vector for distributing infostealers, as threat actors leverage polished tutorial-style clips to trick Windows users into running malicious code.

Attackers create accounts with Windows-like naming and branding, then post short, high-production-value videos that mimic authentic support or how-to content.

The posts are optimized with relevant tags and keywords so they surface alongside legitimate troubleshooting material, increasing their reach through platform recommendation algorithms.

The social engineering is blunt yet effective: viewers are instructed to open an elevated PowerShell session and paste in a command or to visit a linked download page.

Those steps, framed as necessary “activation” or “fix” routines, pull down and execute malware rather than delivering any legitimate software or premium service.

Recent research from ReversingLabs, corroborated by Malwarebytes and other industry and national cybersecurity advisories, describes campaigns that present deceptively legitimate “activation” or “free premium” videos for Spotify, Microsoft Office, and Windows that ultimately deliver payloads like the Vidar infostealer.

Technical analysis shows the campaigns rely on standard but potent techniques. The PowerShell commands commonly download an intermediary script or executable that disables or adds exclusions to Windows Defender, then fetches the infostealer.

Fake Windows and Office Activation Videos

Vidar observed in these attacks is a feature-rich information stealer that harvests saved browser credentials, autofill data, cookies, cryptocurrency wallet data, TOR browser profiles, and often data related to two-factor authentication.

Harvested data is exfiltrated to attacker-controlled command-and-control infrastructure for sale or direct abuse. Earlier campaigns with similar social-media-driven tactics echo the same pattern: initial contact through a short video, pressure to act quickly, and remote delivery of a commodity stealer.

These campaigns are notable for two reasons. First, attackers are shifting away from traditional email phishing and toward platforms where short, engaging media and algorithmic surfacing can create high-volume exposure with minimal effort.

Second, the abuse of native OS tooling like PowerShell, combined with anti-virus disablement routines, reduces the need for complex exploitation: social engineering plus legitimate administration channels become the infection vector.

ReversingLabs’ disclosure and prior reporting by Malwarebytes highlight that this model is reproducible and scalable, meaning copycat operations or variations such as malicious “activation” guides for other software or fake coupon offers are likely to proliferate.

Defenders and users need pragmatic, actionable controls. At the user level: never paste or run commands from social media, avoid unofficial activation or “cracked” software, and download applications only from vendor sites or trusted app stores. Verify digital signatures on any downloaded installers and be skeptical of files lacking a clear publisher.

Use strong, unique passwords and hardware-based or app-based two-factor authentication to mitigate credential theft.

From a technical controls perspective: enforce application allowlisting, restrict PowerShell execution policies and block script-based downloads at the network perimeter, and ensure endpoint protection platforms are configured to detect behavior-based indicators (creation of Defender exclusions, unusual process injection, credential-stealing behaviors) rather than relying solely on signature matches.

Organizations should also treat short-form video platforms as part of the threat landscape and include them in phishing and social-engineering awareness training.

Security teams can proactively search for brand- and product-related terms on these platforms and report suspicious accounts.

The convenience and virality of short videos make them attractive to both legitimate creators and opportunistic attackers. The remedy combines informed users, tighter endpoint controls, and continuous monitoring of emerging social-media-driven attack patterns to keep infostealers like Vidar from turning casual viewing into a full compromise.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.