Threat actors are using TikTok to bait users into installing credential-stealing malware, with free Spotify Premium access as the hook.
The attack runs in stages. Videos posted on TikTok advertise a method to unlock Spotify Premium for free. Viewers who follow along are directed off-platform to download a file and run it using command-line tools, bypassing the browser warnings and app-store friction that most people have been conditioned to treat as a stop sign. Once executed, the malware harvests stored passwords.
The command-line delivery detail is worth noting. It filters for victims who are technically confident enough to open a terminal but not skeptical enough to ask why a music-streaming shortcut needs shell access. TikTok's recommendation engine compounds the exposure: a single convincing video can reach millions of users who never searched for it.
The "free premium subscription" lure is as old as piracy forums. What keeps changing is the surface. Social video turns out to be a reliable place to find audiences willing to follow step-by-step instructions from strangers.