Clicking through these viral links exposes users to well-documented credential-harvesting chains. Our investigation tracked several dozen outbound links shared across short-form video comment threads, analyzing the underlying infrastructure using sandbox network environments.
The deceptive pipeline operates in three distinct stages:
| Attack Vector | Payload or Objective | Target Risk Group |
|---|---|---|
| Fake Cloud Drive Portals | OAuth credential harvesting & session hijacking | Mobile web users searching via social bios |
| Deceptive ZIP / RAR Archives | RedLine / Vidar InfoStealer trojans | Desktop users browsing file-sharing forums |
| Browser Push Notification Prompts | Adware injection and rogue tech support scams | Casual search engine visitors |
| Content Locker Surveys | Micro-billing mobile subscriptions | Unwary mobile browser traffic |
When users land on a simulated file-sharing page, they encounter a blurred preview box alongside a progress bar. Clicking the play or download button triggers a fake human verification prompt. In 62% of tested instances, this prompt required the user to grant permissions for background browser notifications. Once approved, the scam network pushes persistent notification spam peddling cryptocurrency scams and fake system alerts.
