Cybercriminals are again turning TikTok into a trap for unsuspecting users. This time, they’re disguising malicious downloads as free activation guides for popular software like Windows, Microsoft 365, Photoshop, and even fake versions of Netflix and Spotify Premium. This means scammers are posting fake how-to videos on TikTok that claim to “activate” or unlock popular software, but the instructions actually install malware on your device.
Security expert Xavier Mertens first spotted the campaign, confirming that the same kind of scheme was seen earlier this year. According to BleepingComputer, these fake TikTok videos show short PowerShell commands and instruct viewers to run them as administrators to “activate” or “fix” their programs.
In reality, those commands connect to a malicious website and pull in malware known as Aura Stealer, which quietly siphons saved passwords, cookies, cryptocurrency wallets, and authentication tokens from the victim’s computer.
Credit: Bleeping Computer
How the TikTok scam works
This campaign uses what experts call a ClickFix attack. It’s a social engineering trick that makes victims feel they’re following legitimate tech instructions. The instructions seem quick and simple: run one short command and get instant access to premium software.
But instead of activating anything, the PowerShell command connects to a remote domain named slmgr[.]win, which downloads harmful executables from Cloudflare-hosted pages. The main file, updater.exe, is a variant of the Aura Stealer malware. (FYI, Aura Stealer has no connection to the security company Aura. It’s simply a malware strain that happens to share part of the name. Malware authors often pick common words, techy-sounding names, or names close to legit products to look more believable. This is one of those cases.)
Once inside the system, the Aura Stealer malware hunts for your credentials and sends them back to the attacker.
Another file, source.exe, uses Microsoft’s C# compiler to launch code directly in memory, making it even harder to detect. The purpose of this extra payload isn’t fully known yet, but the pattern follows previous malware used for crypto theft and ransomware delivery.
How to stay safe from TikTok malware scams
Even though these scams look convincing, you can avoid becoming a victim with the right precautions.
1) Avoid shortcuts
Never copy or run PowerShell commands from TikTok videos or random websites. If something promises free access to premium software, it’s likely a trap.
2) Use trusted sources
Always download or activate software directly from the official website or through legitimate app stores.
3) Keep security tools updated
Outdated antivirus or browsers can’t detect the latest threats. Update your software regularly to stay protected.
4) Use strong antivirus software
Install strong antivirus software that offers real-time scanning and protection against trojans, info-stealers, and phishing attempts.
The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.
5) Sign up for a data removal service
If your personal data ends up on the dark web, a data removal or monitoring service can alert you and help remove sensitive information.
While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.
Is your personal information exposed online?
Run a free scan to see if your personal info is compromised. Results arrive by email in about an hour.
6) Reset credentials
If you’ve ever followed suspicious instructions or entered credentials after watching a “free activation” video, reset all your passwords immediately.
7) Reset passwords
If you’ve ever followed suspicious instructions or entered credentials after watching a “free activation” video, reset all your passwords immediately. Start with your email, financial, and social media accounts. Use unique passwords for each site. Consider using a password manager, which securely stores and generates complex passwords, reducing the risk of password reuse.
Next, see if your email has been exposed in past breaches. Our #1 pick, NordPass, includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials.
8) Enable multi-factor authentication
Add an extra layer of security by turning on multi-factor authentication wherever possible. Even if your passwords are stolen, attackers won’t be able to log in without your verification.
Related Links:
- New 401(k) tax rules could expose you to scams
- Beware of these fake credit card account restriction scams
- Payroll scam hits U.S. universities as phishing wave tricks staff
Kurt’s key takeaways
TikTok’s global reach makes it a prime target for scams like this. What looks like a helpful hack could end up costing your security, your money, and your peace of mind. Stay alert, trust only verified sources, and remember that there’s no such thing as a free activation shortcut.
Is TikTok doing enough to protect its users from scams like this? Let us know your thoughts in the comments below.
FOR MORE OF MY TECH TIPS & SECURITY ALERTS, SUBSCRIBE TO MY FREE CYBERGUY REPORT NEWSLETTER HERE
Copyright 2025 CyberGuy.com. All rights reserved. CyberGuy.com articles and content may contain affiliate links that earn a commission when purchases are made.