TikTok
UNSPLASH

The Nigerian Communications Commission's Computer Security Incident Response Team has warned users against participating in the "Invisible Challenge" on TikTok, stating it could expose their devices to information-stealing malware.

Threat actors are taking advantage of the viral TikTok challenge to scatter a malware known as WASP (or W4SP) stealer, according to an advisory by the NCC-CSIRT.

The commission said in a statement signed by spokesperson Reuben Muoka that the WASP stealer is a persistent malware hosted in discord that its developer claims are undetectable. It has a high probability and critical damage potential, the commission added.

"The Invisible Challenge involves wrapping a somewhat transparent body contouring filter around a presumed naked individual. Attackers are uploading videos to TikTok with a link to software that they claim can reverse the filter's effects," the commission said.

How does the hack work?

Hackers are luring users by uploading videos to TikTok as part of the latest trend, but attaching a link to a software called "unfilter" that allegedly removes the filter from the video.

Clicking on the link or trying to download the software will infect your device with a virus, according to the NCC.

Authorities have warned that the malware can illegally harvests important information - including passwords, financial activity, and keystrokes from emails and chat programs. Furthermore, the malware might be capable of collecting screenshots, video recordings, or anything connected to the camera or microphone.

The viral TikTok trend challenge requires participants to record naked videos of themselves and use TikTok's "Invisible Body" filter to superimpose their bodies with a hazy background.

The challenge is quite popular on TikTok at the moment and has amassed over 25 million views.

Here are some ways to prevent cyber attacks, according to the Nigerian Communications Commission:

  • Avoid clicking on suspicious links.
  • Use anti-malware software on your devices.
  • Check the app tray and remove any apps that you don't remember installing or that are dormant.
  • Use a password manager to practice healthy password hygiene.

Unfortunately, this isn't the first time TikTok has had to deal with an issue like this. Back in August of 2022, Microsoft discovered a high-severity vulnerability within the TikTok Android application that could have given attackers the ability to compromise user accounts with just a single click.