If a TikTok 'tech tip' tells you to paste code, it's a scam. Here's what's really happening

Follow ZDNET: Add us as a preferred source on Google. TikTok is being exploited as a delivery platform to spread information-stealing malware and other payloads, with free software acting as the bait. On October 17, Senior ISC Handler Xavier Mertens said in a post published on the SANS Institute's Internet Storm Center website that the wave of attacks on TikTok leverages ClickFix social engineering techniques to dupe victims into downloading malware onto their systems. Also: This new cyberattack tricks you into hacking yourself. Here's how to spot it In the example video posted by Mertens, a scammer has posted content -- with over 500 likes -- which pretends to provide watchers with an easy way to activate Photoshop for free. The victim is asked to start PowerShell as an administrator and trigger one line of code, which then executes "Updater.exe," which is actually AuroStealer, a Trojan designed to steal credentials and system information. An additional shellcode is also launched in memory. ZDNET explored TikTok for similar videos and it was surprising how many were live. For example, in the screenshot below, the author was promoting a fake way to download and install Adobe Photoshop without the need for a license. Other examples we found included fake, free ways to license Microsoft Windows. Clickfix is a particularly nasty social engineering technique that tries to bypass traditional anti-phishing protections by tricking users into "hacking" themselves. Also: Best VPN serv...