TikTok-Delivered Infostealer: ClickFix Campaign Compromises Credentials
In October 2025, a widespread campaign leveraged TikTok videos masquerading as free activation guides for popular software titles—including Windows, Adobe products, and Spotify—to distribute information-stealing malware. Attackers used "ClickFix" social engineering to instruct viewers to run obfuscated PowerShell commands, delivering the Aura Stealer infostealer and an additional payload via Cloudflare-hosted executables. The attack enabled threat actors to harvest browser credentials, authentication cookies, and wallet data from victims, leading to high risk of account compromise and data theft. Infection occurred after users were tricked into executing single-line commands under the guise of software activation or fixes. This incident highlights the increasing weaponization of social media platforms as initial access vectors for malware and demonstrates the growing sophistication of infostealer campaigns. The trend underscores the urgent need for organizations to address social engineering risks and update awareness programs as attackers rapidly innovate their distribution methods.
Kill Chain
