TikTok’s “Scam-Yourself” Trap: How AuraStealer Malware Tricks Users into Hacking Their Own PCs

A deep-dive analysis by Gen Digital (Gen Threat Labs) has unveiled AuraStealer, an emerging Malware-as-a-Service that is gaining traction through a social-engineering campaign on TikTok, described as a “Scam-Yourself” trap. Active since July 2025, it is marketed as a high-efficiency tool capable of draining data from Windows systems from Windows 7 to 11.

Victims are lured by videos promising free activation of otherwise paid software, and the trap triggers when users are instructed to retype a command into an administrative PowerShell window, which then downloads and executes the malicious payload. The malware employs extensive anti-analysis and obfuscation techniques to hinder detection, including indirect control flow and exception-driven API hashing, while attempting to bypass security features such as Application-Bound Encryption in Chromium browsers.

Gen Digital notes that subscriptions for AuraStealer range up to $585 a month, yet its flaws leave it detectable and its performance not yet fully polished, underscoring that online tutorials promising freebies may come at a high price. According to Gen Digital’s analysis, the campaign leverages social platforms to recruit victims and relies on users’ self-compromise rather than silent drives.