Full Report
Cybercriminals are using TikTok videos to trick users into infecting themselves with Vidar and StealC information-stealing malware in ClickFix attacks. [...]
Analysis Summary
This summary focuses on the **ClickFix social engineering tactic** and the malware frequently associated with it, particularly **infostealers**, as featured in TikTok-based campaigns, alongside mentions of specific malware like **WASP Stealer**.
# Tool/Technique: ClickFix Social Engineering Tactic
## Overview
ClickFix is a social engineering tactic that leverages platforms like TikTok to distribute malicious content. Attackers design videos to trick potential targets into running malicious scripts, often via prompts or perceived fixes/solutions, leading to the download and installation of malware, typically infostealers, on compromised systems.
## Technical Details
- Type: Technique (Social Engineering / Delivery)
- Platform: Primarily targets Windows users, but has been adapted for macOS and Linux.
- Capabilities: Deception via trending platforms (TikTok) to coerce users into executing code.
- First Seen: Not explicitly dated, but noted as a modern adaptation of social engineering exploiting current trends.
## MITRE ATT&CK Mapping
This covers the delivery and execution phase associated with ClickFix abuses:
- **TA0001 - Initial Access**
- T1566 - Phishing
- T1566.002 - Spearphishing Link (If the link/video directs to a download)
- **TA0002 - Execution**
- T1059 - Command and Scripting Interpreter
- T1059.001 - PowerShell (Often used for initial payload execution on Windows)
## Functionality
### Core Capabilities
- **Social Engineering via Media:** Using TikTok videos to drive user interaction toward a malicious goal (e.g., clicking a link, running a fix).
- **Cross-Platform Targeting:** While Windows is primary, the technique is adaptable to macOS and Linux environments.
- **Payload Delivery:** Delivering payloads such as infostealer malware.
### Advanced Features
- **State-Sponsored Adoption:** The tactic has been adopted by nation-state actors (APT28, ColdRiver, Kimsuky, MuddyWater) for espionage campaigns.
- **Exploitation of Trends:** Capitalizing on popular video formats or challenges (e.g., 'Invisible Challenge') to gain views and trust.
## Indicators of Compromise
*Indicators listed are derived from the malware types often delivered via this technique, not specific to the ClickFix method itself.*
- File Hashes: [Not provided in the text]
- File Names: [Not provided in the text]
- Registry Keys: [Not provided in the text]
- Network Indicators: [Not provided in the text]
- Behavioral Indicators: Execution of suspicious PowerShell commands following user interaction based on social media prompts; installation of unknown software claiming to be a "fix."
## Associated Threat Actors
- APT28 (Russia)
- ColdRiver (Russia)
- Kimsuky (North Korea)
- MuddyWater (Iran)
- General cybercriminals and scammers.
## Detection Methods
*Detection methods will be based on the delivered malware (e.g., Infostealers like Lumma) and the execution attempts.*
- Signature-based detection: Signatures for known associated infostealers (e.g., Lumma, WASP Stealer).
- Behavioral detection: Monitoring for execution of PowerShell scripts initiated by user interaction stemming from external links/prompts.
- YARA rules: Rules targeting string patterns or structures within the final malicious binaries.
## Mitigation Strategies
- **User Education:** Training users to be highly skeptical of software "fixes" or links promoted via social media, especially TikTok.
- **Endpoint Hardening:** Restricting PowerShell execution capabilities for non-administrative users where possible.
- **Application Control:** Implementing controls to prevent the execution of newly downloaded binaries or scripts.
- **Platform Security:** Reviewing security updates for macOS and Linux environments targeted by these adaptations.
## Related Tools/Techniques
- **WASP Stealer (Discord Token Grabber):** Malware specifically mentioned as being distributed via a TikTok 'Invisible Challenge' video infection mechanism.
- **Lumma Infostealer:** A type of general infostealer malware often being distributed via tactics like ClickFix.
- **Fake IT Tools/Software Distribution:** Similar social engineering approach where fake troubleshooting or fix tools are presented (e.g., Interlock ransomware gang using fake IT tools).
---
# Malware Family: WASP Stealer (Discord Token Grabber)
## Overview
WASP Stealer is an information-stealing malware, specifically noted for its capability to act as a Discord Token Grabber. It was previously distributed via TikTok videos capitalizing on a trending challenge.
## Technical Details
- Type: Malware family (Infostealer/Token Grabber)
- Platform: Implied to target environments where Discord (and potentially Python/related libraries) is used, likely Windows initially.
- Capabilities: Stealing Discord accounts (tokens), passwords, credit card information, and cryptocurrency wallet data.
- First Seen: Associated with a TikTok challenge distribution method that gained significant traction.
## MITRE ATT&CK Mapping
- **TA0009 - Collection**
- T1555 - Credentials from Password Stores
- T1555.004 - Keystroke Monitoring (Implied capability of many infostealers)
- **TA0010 - Exfiltration**
- T1041 - Exfiltration Over C2 Channel
## Functionality
### Core Capabilities
- Harvesting sensitive data stored on the victim machine, including authentication tokens.
- Targeting Discord application data.
- Stealing payment information (credit cards).
- Targeting cryptocurrency wallet credentials.
### Advanced Features
- Polymorphic nature (mentioned in the source context regarding its evolution).
- High visibility distribution method using high-view TikTok videos.
## Indicators of Compromise
- File Hashes: [Not provided in the text]
- File Names: [Not provided in the text]
- Registry Keys: [Not provided in the text]
- Network Indicators: C2 communication channels used to exfiltrate stolen data. [Not provided in the text]
- Behavioral Indicators: Attempts to read application data folders related to Discord, web browsers, and crypto wallets.
## Associated Threat Actors
- General cybercriminals promoting malware through social media trends.
## Detection Methods
- Signature-based detection: Signatures for WASP Stealer binaries.
- Behavioral detection: Monitoring for unauthorized reads/access to credential stores or crypto wallet files.
## Mitigation Strategies
- **Application Security:** Ensuring Discord and other sensitive applications are kept updated.
- **Principle of Least Privilege:** Limiting what applications can access on the system.
- **Security Awareness:** Caution against downloading or running files associated with unverified online challenges or fixes.
## Related Tools/Techniques
- Lumma Infostealer (Another common infostealer distributed via similar vectors).
- ClickFix Tactic (The distribution method used).