Hackers Use AI-Generated Videos on TikTok to Spread Info-Stealing Malware

TrendMicro has uncovered a sophisticated campaign where threat actors are exploiting TikTok to distribute information-stealing malware.

By leveraging AI-generated videos posing as tutorials for unlocking pirated software, cybercriminals trick unsuspecting viewers into executing malicious PowerShell commands.

These commands download dangerous malware strains such as Vidar and StealC, designed to harvest sensitive data from infected systems.

A New Frontier in Social Media Cyber Threats

What makes this attack particularly alarming is its massive reach, with some videos garnering nearly half a million views, raising concerns about the scale of potential victims.

The deception begins with seemingly harmless videos that guide users to run PowerShell scripts, initiating a chain of malicious downloads.

Digging deeper into the campaign, historical DNS data reveals that domains like amssh[.]co and allaivo[.]me, now offline or seized, previously resolved to IP addresses such as 91.92.46.76 and 91.92.46.219.

According to Censys Report, these hosts served PowerShell scripts, with some still active as of May 23, 2025, delivering payloads like Lumma Stealer, flagged by tools like VirusTotal.

Network of Malicious Infrastructure

Further investigation into associated IPs, including 91.92.46.70, uncovers ties to bulletproof hosting providers under AS214196 (“VLADYLSAV-NAUMETS”), a recently registered autonomous system advertising anonymity with no KYC requirements.

This setup, paired with upstream provider AS213887 (“WAIcore”), also newly established, paints a picture of a shadowy infrastructure designed to evade detection.

Historical scans also show additional services and scripts on other related IPs like 147.45.44.233 and 176.98.186.23, though these hosts are currently offline, leaving some questions unanswered.

This campaign highlights the evolving tactics of cybercriminals who weaponize popular platforms like TikTok, blending social engineering with advanced technology like AI to maximize their impact.

The use of bulletproof hosting further complicates mitigation efforts, as these services are built to resist takedowns.

TrendMicro’s initial report provided key indicators of compromise (IOCs), but expanded research has unearthed additional IPs, domains, and hashes, painting a fuller picture of the threat landscape.

Below is an updated table of IOCs to aid in detection and response efforts, underscoring the need for heightened vigilance among users and robust security measures to combat such insidious threats.

Updated Indicators of Compromise (IOCs)

Type	Value
Hash	3bb81c977bb34fadb3bdeac7e61193dd009725783fb2cf453e15ced70fc39e9b
Hash	afc72f0d8f24657d0090566ebda910a3be89d4bdd68b029a99a19d146d63adc5
Hash	b8d9821a478f1a377095867aeb2038c464cc59ed31a4c7413ff768f2e14d3886
Hash	56ce9b8314d4cf1240ab7ce06fa77a8d153742be3bf0167312f3827eb9cc2656
Hash	530ac7b77d252f2b62befff3a1bad47ada3ad3f528a897aae74391e64d9e907e
URL	hxxp://91[.]92[.]46[.]70/1032c730725d1721[.]php
URL	hxxps://allaivo[.]me/spotify
URL	hxxps://amssh[.]co/file[.]exe
URL	hxxps://amssh[.]co/script[.]ps1
URL	hxxps://steamcommunity[.]com/profiles/76561199846773220
URL	hxxps://t[.]me/v00rd
URL	hxxps://winbox[.]ws/crypted[.]exe
URL	hxxps://winbox[.]ws/script[.]ps1
IP	hxxps://49[.]12[.]113[.]201
IP	hxxps://116[.]202[.]6[.]216
IP	91[.]92.46.76
IP	91[.]92.46.219
IP	147[.]45.44.233
IP	176[.]98.186.23
IP	91[.]92.46.70
CIDR	91.92.46.0/24 (bulletproof hosting provider)
CIDR	166.88.225.0/24 (bulletproof hosting provider)
ASN	214196 (bulletproof hosting provider

Find this News Interesting! Follow us on Google News, LinkedIn, & X to Get Instant Updates!