{"id":26210,"date":"2026-09-21T15:16:02","date_gmt":"2026-09-21T23:16:02","guid":{"rendered":"https:\/\/www.palada.net\/index.php\/2026\/09\/21\/phishing-attacks-leverage-tiktok-instagram-reels\/"},"modified":"2026-09-21T15:16:02","modified_gmt":"2026-09-21T23:16:02","slug":"phishing-attacks-leverage-tiktok-instagram-reels","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2026\/09\/21\/phishing-attacks-leverage-tiktok-instagram-reels\/","title":{"rendered":"Phishing attacks leverage TikTok, Instagram Reels"},"content":{"rendered":"
\n
\n

Short-form videos on social media apps are currently being leveraged by threat actors as a phishing vector, utilizing tutorial style content with the promise of free premium software to lure victims onto malicious sites.\u00a0<\/p>\n

This is an important threat to be cognizant of, as the videos can trick users into directly downloading malware. In order to best defend organizations, steps can be taken to mitigate the risks associated with these videos, both in user training and technical guardrails.\u00a0<\/p>\n

Here\u2019s what these malicious videos look like, how they work \u2014 and why they are so successful. ReversingLabs (RL) analyzed the phenomena\u2019s two distinct campaigns, which both managed to reach a large audience by leveraging different metrics to game the content recommendation algorithms.\u00a0<\/p>\n

The campaigns<\/h2>\n

If you\u2019ve used social media, you know that sometimes it recommends solutions to problems you never thought about solving. Most of the time, you don\u2019t need these problems solved, but sometimes you stumble across something actually useful. Someone offers you an easy way to get free software, like Spotify Premium or Microsoft Word. The video looks like everything else you\u2019ve seen during your scroll, and those thousands of views and hundreds of likes have to count for something.<\/p>\n

Unfortunately the algorithm and your trust in social media has signed you up for malware, with the likes of Vidarstealer<\/span><\/a> on the table. The tutorial was too good to be true and now a mess is on your hands.\u00a0<\/p>\n

During RL researcher\u2019s investigation of malicious social media videos, two different lure techniques were observed across accounts and social media platforms. Primarily conducted on TikTok and Instagram Reels, these campaigns use the same template to mass produce videos and make regular posts. Either approach is a means to a different end, and the differences demonstrate how attackers can leverage different aspects of social media engagement to reach more potential victims.\u00a0<\/p>\n

One methodology involves fake tutorials for software installs, with professional sounding voice overs and clean graphics. The second approach relies on posts demonstrating how to use premium software for free, spanning multiple videos, with a centralized tutorial being introduced after the account gains traction.\u00a0 Regardless of the differing hooks, both campaign tactics seek to drive viewers to a secondary website hosting free software of dubious intent.\u00a0<\/p>\n

Method one: Malicious tutorials<\/h3>\n

The malicious tutorial campaigns come from\u00a0 a myriad of almost identical accounts, with usernames like \u201cwindows.tips\u201d or \u201cwindows.insights\u201d and the same blue and white profile picture.<\/p>\n

\n