CEM REPORT, ICT | Nigerians have been warned against taking part in the TikTok Invisible Challenge.
According to the Nigerian Communications Commission’s Computer Security Incident Response Team (NCC-CSIRT), partakers in the challenge face the risk of surrendering vital information to hackers.
The NCC-CSIRT in an advisory said threat actors took advantage of the viral Invisible Challenge to disseminate an information-stealing malware known as the WASP (or W4SP) stealer.
The commission explains that the WASP stealer, which is high in probability with critical damage potential, is a persistent malware hosted on discord that its developer claim is undetectable.
Furthermore, NCC-CSIRT explained that the Invisible Challenge involves wrapping a somewhat transparent body contouring filter around a presumed naked individual.
Attackers are uploading videos to TikTok with a link to software that they claim can reverse the filter’s effects.
“Those who click on the link and attempt to download the software, known as “unfiltered,” are infected with the WASP stealer. Suspended accounts had amassed over a million views after initially posting the videos with a link. Following the link leads to the “Space Unfiltered” Discord server, which had 32,000 members at its peak but has since been removed by its creators.
“Successful installation will allow the malware to harvest keystrokes, screenshots, network activity, and other information from devices where it is installed. It may also covertly monitor user behaviour and harvest Personally Identifiable Information (PII), including names and passwords, keystrokes from emails, chat programs, websites visited, and financial activity. This malware may be capable of covertly collecting screenshots, video recordings, or the ability to activate any connected camera or microphone.”
To forestall such attacks the NCC-CSIRT Team listed the following to include avoiding clicking on suspicious links, using anti-malware software on your devices, checking your app tray and removing any apps that you do not remember installing or that are dormant, and embracing healthy password hygiene practices such as using a password manager.
