{“lastseen”:”2026-06-10T18:05:09″,”description”:”Short-form video platforms like TikTok and Instagram Reels have become the latest way cybercriminals spread malware.\\n\\nWe’ve already seen attackers move away from traditional phishing emails and toward tactics that trick people into installing malware themselves. Now they’re being lured with slick social media videos that promise free Spotify Premium, free Windows activation, or free Microsoft Office, but instead leave people with infostealers on their Windows devices.\\n\\nResearchers at ReversingLabs uncovered two active campaigns that use short videos to trick users into running dangerous PowerShell commands or visiting malicious download sites. Similar campaigns have been reported by other researchers and national cybersecurity agencies, suggesting a growing trend: Cybercriminals are learning how to use social media algorithms just as effectively as marketers.\\n\\nIn true social media fashion, the videos on platforms like TikTok and Instagram Reels claim to solve a problem you didn\u2019t know you had. The catch is that following the instructions delivers malware to your device.\\n\\n## How the scam works\\n\\nThe first campaign looks deceptively professional. \\n\\nAccounts with names like \u201cwindows.tips\u201d or \u201cwindows.insights\u201d use Windows-style branding and post polished tutorial videos that resemble genuine tech support content. The videos are tagged with Windows and Office-related keywords so they appear alongside legitimate troubleshooting and tips content.\\n\\nThe videos promise to unlock Spotify Premium, Microsoft Office, or Windows for free. Viewers are then guided through step-by-step instructions that include opening Powershell, a legitimate Windows admin tool, and pasting in commands. Those commands download and run malware, much like the ClickFix scams we’ve covered before.\\n\\nThe malware was identified as Vidar, an infostealer designed to steal sensitive informtion from infected devices. Vidar commonly targets:\\n\\n * Saved browser passwords\\n * Autofill data\\n * Browser cookies\\n * Cryptocurrency wallets\\n * Two-factor authentication (2FA) data\\n * TOR browser data\\n\\n\\n\\nThe stolen information is then sent back to servers controlled by the attackers.\\n\\n## How to stay safe\\n\\nResearch into similar TikTok-based attacks shows these scripts commonly add exclusions to Windows Defender, making it harder for security software to detect future malicious activity.\\n\\nFortunately, there are a few simple ways to protect yourself: \\n\\n * Only download software from official vendor websites. \\n * Be skeptical of \u201cfree\u201d, cracked, or unofficial versions of paid software. \\n * Don\u2019t follow instructions on a webpage without thinking them through, especially if the page asks you to run commands on your device or copy and paste code. Many ClickFix pages use countdowns, fake user counters, or other pressure tactics to make you act quickly.\\n * Check that downloaded files match what you expected to download.\\n * Verify a file\u2019s publisher and digital signature before you run it. On Windows, you can usually check this by right-clicking the file, selecting **Properties** \\u003e **Digital Signatures**. Keep in mind that a valid signature does not guarantee a file is safe, but missing or suspicious signatures are often a red flag. \\n * Use a real-time, up-to-date anti-malware solution to block malware like infostealers before it runs.\\n\\n\\n\\nPro tip: If you’re unsure whether a video, message, or website is legitimate, you can ask Malwarebytes Scam Guard about it. It can help identify suspicious content and advise you on what to do next.\\n\\n_Image courtesy ofReversingLabs_\\n\\n* * *\\n\\n**We don\u2019t just report on threats\u2014we remove them**\\n\\nCybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.”,”published”:”2026-06-10T16:27:32″,”modified”:”2026-06-10T16:27:32″,”type”:”malwarebytes”,”title”:”Free Spotify Premium hacks on social media are spreading infostealers”,”source”:””,”references”:””,”id”:”MALWAREBYTES:95A8ECD9872DF7229220B505B4643076″,”bulletinFamily”:”blog”,”cwe”:null,”cvelist”:[],”sourceData”:””,”sourceHref”:””,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.malwarebytes.com\/blog\/news\/2026\/06\/free-spotify-premium-hacks-on-social-media-are-spreading-infostealers”,”category_name”:”News”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-06-10T18:05:09″,”description”:”Short-form video platforms like TikTok and Instagram Reels have become the latest way cybercriminals spread malware.\\n\\nWe’ve already seen attackers move away from traditional phishing emails…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[6,8,12,115,13,33,7,11,5],"class_list":["post-61717","post","type-post","status-publish","format-standard","hentry","category-category_news","tag-cve","tag-cvss","tag-exploit","tag-malwarebytes","tag-news","tag-none","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n