Fake Spotify Premium PowerShell "Hack" Drops Vidar Infostealer

Researchers at ReversingLabs have found two campaigns running on TikTok and Instagram Reels that push Vidar, an infostealer that has been kicking around since 2018 and picked up a quiet stability and evasion upgrade in October 2025. The bait is the oldest one in the book: free access to paid software, served up in short, polished videos that look like genuine tech tips.

The fake Microsoft help desk

The first campaign uses accounts dressed up to look Microsoft-adjacent. Names like windows.tips and windows.insights, blue-and-white logos, the whole costume. The videos walk viewers through opening PowerShell and pasting in a command that supposedly unlocks Spotify Premium.

It does nothing of the sort. The command pulls down Vidar, which then helps itself to saved browser credentials, card details and session tokens. One of these tutorials racked up more than 100,000 views along with thousands of saves and shares, which is exactly the engagement profile recommendation algorithms reward.

The scrappier cousin

The second campaign is less polished. Accounts post a stream of short clips claiming various premium apps have been cracked, then funnel viewers into the comments, DMs or a link in the bio. From there it is the familiar maze of surveys, redirects and shady download portals.

The researchers could not get to the final payload because they could not finish the surveys. That is quite telling. It suggests there is a meaningful population of users out there willing to grind through pages of dodgy questionnaires for the chance of a free Spotify account, and that is the audience these operators are sorting for.

Why this is hard to clean up

Most of the friction here is on the platform side. Creators can delete comments warning others off and block anyone calling out the scam, which means the warnings don't accumulate the way they would on a forum or a review thread. ReversingLabs reported several of these videos to Instagram as scams and were told they did not breach the rules. New accounts appear faster than the old ones come down.

There is also a format problem. A short vertical video with a confident voiceover and some motion graphics looks identical whether the advice is real or ruinous. The interface gives no signal either way, and the algorithm boosts whatever holds attention.

The line worth holding

If there is one thing worth carrying away from this, it is the shape of the lure rather than the specific malware. No legitimate Spotify, Adobe or Microsoft tip will ever involve pasting a command into PowerShell. None. That step is the entire attack, dressed up in a tutorial format because the tutorial format is what makes people trust it.

Vidar will be renamed, repackaged and pushed through the next platform that allows short video and a comments section. The PowerShell lure won't be the last delivery method either. But the principle is durable: a stranger on a feed telling you to run a command on your own machine is not helping you.