TikTok Videos Weaponized to Deliver Self-Compiling PowerShell Malware

TikTok videos are being weaponised to deliver self-compiling PowerShell malware, with attackers posing as providers of free software activators and urging viewers to run a PowerShell one-liner as an administrator. According to ISC SANS, victims are directed to a link that fetches a PowerShell payload via Invoke-Expression and Invoke-RestMethod from a malicious host, after which a second stage Updater.exe is downloaded from file-epq.pages[.]dev.

The initial payload has a SHA256 of 6D897B5661AA438A96AC8695C54B7C4F3A1FBF1B628C8D2011E50864860C6B23 and currently shows a VirusTotal detection rate of 17/63, indicating its novelty and evasion. Updater.exe is identified as AuroStealer, a credential-harvesting trojan that exfiltrates browser passwords and cryptocurrency wallets; it creates a scheduled task with legitimate names such as AdobeUpdateTask or WindowsUpdateCheck to persist.

A further payload, source.exe, uses on-the-fly in-memory compilation via the .NET compiler csc.exe, enabling fully in-memory execution without touching the disk, and evading static analysis. The campaign also features other TikTok videos with lures like “Activate Office” or “Unlock Windows,” suggesting ongoing iteration of social-engineering themes.