Malware

Vidarstealer

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

6 distinct techniques documented for this family, organized by ATT&CK tactic.

Reconnaissance

1 technique

T1598Phishing for InformationEvidence1

Cybercriminals are now turning to short-form video platforms as a new attack surface, using fake software tutorials on TikTok and Instagram Reels to push malware onto unsuspecting users.

Execution

3 techniques

T1059.001PowerShellEvidence1

These accounts post professional tutorial videos with AI-generated voice overs, walking users through typing a specific PowerShell command that supposedly unlocks Spotify Premium for free. That command instructs Windows to silently download and run a script from a remote address.

T1204User ExecutionEvidence1

When users follow the steps without question, they unknowingly execute a file identified as Vidarstealer.

T1204.002Malicious FileEvidence1

Both campaigns share the same end goal: send users to a third-party website hosting malicious software disguised as a free premium app.

Stealth

1 technique

T1036MasqueradingEvidence1

The first campaign uses accounts with usernames like “windows.tips” or “windows.insights,” paired with a blue and white profile image designed to closely mimic the official Windows social media icon.

Command and Control

1 technique

T1105Ingress Tool TransferEvidence1

That command instructs Windows to silently download and run a script from a remote address.

INDICATORS OF COMPROMISE

IOCs tracked for this family

6 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

5 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

1 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in apptoday

hash.sha256●●●●●●●●●●●●View more in apptoday

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

cyber security newsNews

Jun 10, 2026

Hackers Abuse TikTok and Instagram Reels to Spread Malware via Fake Free Software Tutorials

An infostealer offered as a service that steals login credentials, financial data, and session tokens from infected devices. In this campaign, it is delivered via fake software tutorial videos on TikTok and Instagram Reels that trick users into executing malicious PowerShell commands or downloading fake premium software.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching6

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping6

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.