TikTok videos now push infostealer malware in ClickFix attacks

Trend Micro observed a TikTok-based ClickFix campaign using likely AI-generated videos that instruct viewers to run PowerShell commands which fetch and execute scripts from attacker-controlled URLs (e.g., https://allaivo.me/spotify and https://amssh.co/script.ps1). The payloads install Vidar and StealC info-stealers that can capture screenshots, credentials, credit cards, browser cookies, crypto wallets and Authy data, and establish persistence via registry keys; the campaign leverages TikTok's wide reach to amplify impact.