TikTok, Instagram Reels push PowerShell Vidar infostealer

ReversingLabs researchers identified two active campaigns on TikTok and Instagram Reels that use short tutorial-style videos to trick users into installing Vidar, an infostealer. The videos promise free Spotify Premium, Microsoft Office or Windows activation and direct viewers to run PowerShell commands or to download installers from linked sites.

The accounts use names such as “windows.tips” and “windows.insights” and mimic Windows-style branding. Videos are tagged with Windows and Office keywords so they appear alongside legitimate troubleshooting content. Viewers are told to open PowerShell, paste a command and press Enter; the command downloads and executes malware. In other cases the videos point to malicious download pages hosting infected installers.

The malware has been identified as Vidar. Researchers observed the malware collect saved browser passwords, autofill data, browser cookies, cryptocurrency wallet files, two-factor authentication data and Tor browser files. Some of the attack scripts add exclusions to Windows Defender, reducing the chance that later activity is detected.

The campaigns use platform discovery features and short-form tutorial formats to reach users. Attackers include countdown timers, fake user counters and professional-looking branding to encourage quick action and trust. Because PowerShell is a legitimate Windows administration tool, prompting users to run commands can bypass some defenses that focus on email-based attacks.

Researchers recommend downloading software only from official vendor sites, avoiding unverified or cracked versions, and not copying commands from webpages or videos into a PowerShell window. Users should verify a file’s publisher and digital signature before running it and keep endpoint protection current. Platform operators and security teams are removing fraudulent accounts and monitoring short-form video content, and consumers are advised to confirm technical instructions through official support channels before taking action.