{"id":472001,"date":"2022-11-30T12:03:21","date_gmt":"2022-11-30T10:03:21","guid":{"rendered":"https:\/\/mybroadband.co.za\/news\/?p=472001"},"modified":"2022-11-30T12:05:49","modified_gmt":"2022-11-30T10:05:49","slug":"attackers-exploit-trending-tiktok-challenge-to-spread-malware","status":"publish","type":"post","link":"https:\/\/mybroadband.co.za\/news\/security\/472001-attackers-exploit-trending-tiktok-challenge-to-spread-malware.html","title":{"rendered":"Attackers exploit trending TikTok challenge to spread malware"},"content":{"rendered":"

Malicious actors are exploiting a trending TikTok challenge to trick users into installing malware on their devices, Checkmarx reports<\/a><\/strong>.<\/p>\n

To partake in the “invisible challenge”, TikTok users apply a filter called Invisible Body to their videos, leaving only a silhouette in the video.<\/p>\n

Users filming such videos are often undressed, and viewers have been looking for ways to remove the filter.<\/p>\n

Threat actors have been trying to capitalise on this by posting TikTok videos with links to malware-infested “unfilter” software claiming to remove the filter.<\/p>\n

“Instructions to get the ‘unfilter’ software deploy WASP stealer malware hiding inside malicious Python packages,” explained Checkmarx researcher Guy Nachshon.<\/p>\n

Once deployed, the information-stealing malware targets user passwords, cryptocurrency wallets, and other private information.<\/p>\n

While TikTok has suspended the attackers’ accounts, the videos they posted in November 2022 are estimated to have accumulated over one million views before it took action.<\/p>\n

The attackers also hosted a Discord server \u2014 for which they posted links in video descriptions \u2014 where they pushed links to a GitHub repository hosting the malware to members.<\/p>\n

The Discord server’s member base reached almost 32,000 before it was reported and deleted.<\/p>\n

Despite the adversary renaming the project to “Nitro-generator”, the GitHub account has now been removed.<\/p>\n

The malicious code is said to have been embedded in Python packages, including “tiktok-filter-api”, “pyshftuler”, and “pydesigns”.<\/p>\n

\n

Now read: EskomSePush and other apps used for drug-dealing, child trafficking in South Africa<\/a><\/h2>\n","protected":false},"excerpt":{"rendered":"

Attackers spread the information-stealing malware through Python packages purported to remove the Invisible Body filter.<\/p>\n","protected":false},"author":341076,"featured_media":472005,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[27],"tags":[50307,82981,801,34041,59100],"class_list":["post-472001","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-discord","tag-invisible-challenge","tag-malware","tag-python","tag-tiktok"],"_links":{"self":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/472001"}],"collection":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/users\/341076"}],"replies":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/comments?post=472001"}],"version-history":[{"count":1,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/472001\/revisions"}],"predecessor-version":[{"id":472037,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/472001\/revisions\/472037"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media\/472005"}],"wp:attachment":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media?parent=472001"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/categories?post=472001"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/tags?post=472001"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}