Loading story…
Threat actors used short-form videos on TikTok and Instagram Reels to distribute the Vidar infostealer by masquerading as tutorials for downloading premium software for free. ReversingLabs identified campaigns that relied on near-identical social media accounts, Windows-themed branding, and engagement tactics designed to exploit platform recommendation algorithms. In one case, users were instructed to run a malicious PowerShell command that fetched malware from the lookalike domain msget[.]run; another campaign used comment bait and direct messages to steer victims to survey-gated sites including d4ug[.]site.
The activity showed how social media content can function as a phishing and malware delivery channel at scale, with at least one malicious video exceeding 100,000 views and drawing nearly 1,700 saves. Vidar, a malware-as-a-service infostealer reportedly sold with a $300 lifetime license, is used to steal credentials, financial information, and authentication tokens. ReversingLabs said attempts to report the malicious Instagram posts were rejected, and it urged organizations to restrict software installation privileges, expand phishing awareness training to cover social platforms, and encourage employees to report suspicious posts and messages.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
ReversingLabs published research describing two campaigns that used TikTok and Instagram Reels to distribute malware and scam users with fake free-software offers. The report highlighted how the attackers optimized for saves, shares, comments, and direct messages to exploit recommendation algorithms.
The reference states that a Vidar refresh released last October made the infostealer stealthier. No more specific date is provided for the release.
ReversingLabs said its attempts to report the malicious Instagram posts were rejected. The researchers also noted that attackers could delete warning comments, complicating moderation and user protection.
Threat actors ran social-media malware campaigns on TikTok and Instagram Reels, disguising malicious posts as tutorials for getting premium software for free. One campaign used Windows-themed impersonation and a PowerShell command that downloaded Vidar from msget[.]run, while another used comment bait and DMs leading to survey-gated sites such as d4ug[.]site.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers are using TikTok and Instagram Reels to distribute **Vidar** infostealer through polished short videos that impersonate trusted brands and promise free access to premium software such as Spotify Premium and Microsoft Word. Reporting citing ReversingLabs says the clips use tutorial-style content, AI-generated voiceovers, and engagement bait to persuade users either to visit malicious download pages or to paste terminal and PowerShell commands that silently retrieve and run the malware. The campaign replaces traditional phishing emails with social media-driven social engineering and benefits from recommendation algorithms and weak moderation, with one tracked video reportedly surpassing 109,000 views. **Vidar**, a malware-as-a-service infostealer, can steal passwords, banking data, browser cookies, credentials, and session tokens, while researchers said attacker accounts were able to evade reporting, delete warning comments, and block users who raised concerns. Defenders were urged to treat social platforms as an active malware delivery channel, restrict software installation rights, and train users not to execute untrusted commands from online videos.
Jun 29, 2026
Researchers and incident reports show the **Vidar** infostealer continuing to mature as a credential- and data-theft platform, with operators rotating backend infrastructure, tightening access to affiliate panels, and masking administration through **Tor relays**, **VPN services**, and hosting concentrated in Moldova and Russia. Team Cymru linked the operation to infrastructure including `my-odin[.]com` and several shifting IP addresses, while newer technical analysis found Vidar using multi-stage **PowerShell** delivery, process injection, API hooking, scheduled-task persistence, and theft of browser data by intercepting `CryptProtectMemory` before encryption. The malware targets Windows systems and steals credentials, cookies, autofill data, payment cards, crypto-wallet files, tokens, documents, and screenshots, then exfiltrates the data over encrypted channels. Campaigns tied to Vidar have used increasingly flexible command-and-control discovery and broad distribution channels. Analysts observed samples resolving C2 details dynamically through public profiles on **Faceit**, **Telegram**, and **Steam**, allowing operators to change infrastructure without rebuilding malware. Separate reporting tied Vidar to YouTube lures promoting cracked software and AI-generated tutorial videos, where victims were redirected to fake download sites that delivered stealer payloads. Earlier activity also showed Vidar deployed ahead of **GandCrab** ransomware, stealing victim data before downloading the encryptor, underscoring its role as both a standalone infostealer and a precursor for wider financially motivated intrusions.
Aug 28, 2026
Researchers reported that updated **Vidar** infostealer campaigns are using steganography, fileless execution, and social-engineering lures to evade detection and steal corporate and consumer data. Point Wild and Intrinsec found infections delivered through fake GitHub repositories, compromised WordPress sites showing **ClickFix**-style fake CAPTCHA prompts, gaming cheat posts on Reddit and Discord, and bogus software promoted in YouTube videos and hosted on services such as Mediafire. In one chain, a fake tool named **NeoHub** dropped a malicious DLL disguised as a Microsoft Edge component and signed with counterfeit certificates impersonating GitHub and grow.com. The malware uses VBScript, obfuscated PowerShell, a Go-based loader, and trusted Windows binaries including `WScript`, `PowerShell`, and `RegAsm.exe` to fetch apparently harmless JPEG and TXT files that contain hidden Base64-encoded second-stage payloads, then reconstructs and executes them entirely in memory through .NET reflective loading. Researchers said Vidar now operates as a **Malware-as-a-Service** offering, uses Telegram and Dead Drop Resolver techniques via public Steam profiles to locate command-and-control infrastructure, and exfiltrates credentials, cookies, payment data, cryptocurrency wallet files, and information from more than 200 browser extensions, often through Telegram and Cloudflare-fronted domains to mask attacker activity.
Jun 29, 2026