The WASP malware operators are exploiting the “Invisible Body Challenge” on the video-sharing platform called TikTok to deploy infostealer. Based on reports, the malware could steal passwords, Discord accounts, and credit card information kept on crypto wallets and browsers. Moreover, WASP could file from an infected device.
According to investigations, the target of the infostealing campaign targets people who use a new TikTok Invisible Body Challenge. The video-sharing platform allows users to be naked in front of the camera without being seen by the audience using a filter.
However, the threat actors have posted several TikTok videos with links to a fake software dubbed “unfilter,” which allegedly could remove the filter and expose the people’s bodies.
A researcher reported that TikTok users who posted videos with links inviting potential targets to join their Discord server are called “Space Unfilter.” As of now, the platform has suspended malicious TikTok users.
The WASP malware could initiate infection after a victim accesses the link posted on the attacker-controlled TikTok account.
The infostealer infects the potential victims of the WASP malware after they receive a link posted by a bot account that points to a GitHub repository that stores the infostealer.
The compromised repository has acquired the status of a trending GitHub project. However, its admins have renamed it, and it currently has about 103 stars and nearly 20 forks.
Within the GitHub project’s files is a Windows batch file that installs a hostile Python package on the operation and a ReadMe file that connects links to a YouTube tutorial. The tutorial will prompt the victims to install the TikTok unfilter kit.
The threat actors utilised several Python packages kept on PyPI, with new ones added every instance the old packages are reported or deleted.
The Discord server utilised by the malicious threat actors is now shut down, and the unfilter packages in GitHub have been substituted by Nitro generator files. The method by which the actors tricked their victims has been very problematic for researchers since most of them are willing to take risks to achieve their desires.
Users should be cautious about social media trends, especially the ones that tap into a target’s desire.
