Hackers are exploiting this new TikTok craze to push malware
Cybercriminals have made it big with their malware distribution campaign that leverages a TikTok challenge as well as the ground-breaking promise to see people naked online in order to cause havoc.
The “Invisible Body Challenge” involves recording naked bodies and using a TikTok to remove the filter from the video. A blurry background is then added. The malware claims to be able to remove the filter.
This challenge, like many others on TikTok, became very popular quickly. The hashtag #invisiblebody has been viewed more than 24,000,000 times. Similar to how the malware was distributed, the GitHub repository rose to number one on the list of top-trending repositories.
Fake videos
Cybercriminals took advantage of this opportunity and created videos that allow you to remove the filter to see the original clip uncut.
A link to a Discord Server was included in the description of this video. Users are then directed to a second hyperlink, which will take them to GitHub. There, users are told they can download the “unfiltering” filter which is actually the WASP Stealer (Discord Token Grabber) malware.
This tool steals people’s Discord accounts, passwords, credit card information saved in browsers, cryptocurrency wallets, and even people’s files.
According to BleepingComputer (opens in a new tabTwo videos promoting the fake tool were viewed over a million times. One Discord server has been accessed by more than 30,000 people. A simple Google search for the keywords “Invisible Body TikTok” now serves up dozens of videos promoting fake filter removal tools.
WASP is hosted on GitHub, and soon after the videos hit the web, it achieved the status of “trending GitHub project”.
Both TikTok and GitHub quickly removed the accounts that promoted the scheme from their platforms. The threat actors appear to have quickly returned, using different account names and project names.
Via: BleepingComputer (opens in a new window)
