Malware Distribution via Social Engineering and Malicious Packages

Attackers are increasingly leveraging both social media platforms and software supply chains to distribute malware and post-exploitation frameworks. On TikTok, a video with over 500 likes was discovered promoting a method to illegally activate Photoshop, which in reality instructs users to run a PowerShell command as an administrator. This command fetches and executes malicious PowerShell code from a remote server, with the code identified by a specific SHA256 hash and flagged by multiple antivirus engines. The script then downloads a secondary payload, updater.exe, which is identified as the AuroStealer malware. Persistence is achieved by creating a scheduled task under various plausible system task names, ensuring the malware runs at user logon. The scheduled task is configured to run with the highest privileges and is designed to evade user detection by running in hidden mode. The AuroStealer component is capable of stealing sensitive information from the infected system, posing a significant risk to victims who follow the TikTok video's instructions. Separately, the npm ecosystem was found to be hosting a malicious package named https-proxy-utils, which masqueraded as a legitimate proxy utility. This package cloned functionality from popular proxy packages to appear trustworthy, but included a post-install script that downloaded and executed the AdaptixC2 agent, a post-exploitation framework similar to Cobalt Strike. The malicious npm package was designed to target multiple operating systems, with OS-specific payload delivery mechanisms for Windows, Linux, and macOS. On Windows, the agent was dropped as a DLL in the system directory and executed via DLL sideloading using a copied legitimate executable. On macOS, the payload was placed in the user's autorun directory with a corresponding plist file to ensure persistence. The npm package was quickly removed after discovery, but its presence highlights the ongoing risks in open-source software repositories. Both incidents demonstrate the evolving tactics of threat actors, who exploit both user trust in social media and the software supply chain to deliver sophisticated malware. The use of social engineering on platforms like TikTok lowers the barrier for infection by convincing users to execute malicious commands themselves. Meanwhile, the abuse of npm packages shows how attackers can reach a wide audience of developers and users by mimicking legitimate software. These campaigns underscore the importance of user education, vigilant monitoring of software dependencies, and robust endpoint protection to mitigate the risk of malware infections. Organizations should be aware of these attack vectors and implement controls to prevent the execution of unauthorized scripts and the installation of unverified software. The convergence of social engineering and supply chain attacks represents a significant challenge for defenders, requiring a multi-layered security approach.