This New “Verification” Trick Fools You Into Installing Malware

Cybercriminals are turning to TikTok to spread new scams that promise “free upgrades” or access to premium versions of popular apps.

According to Bleeping Computer, scammers are posting videos that look like tech tutorials, offering so-called activation hacks for software like Windows, Adobe Premiere, or Photoshop, and even fake “premium” services for Netflix and Spotify.

But instead of unlocking anything, these videos trick people into running hidden malware on their devices. Once that happens, attackers can steal passwords, cryptocurrency wallet details, or access to social media and bank accounts.

These “ClickFix” scams, as researchers call them, are spreading quickly because they rely on trust and curiosity. The videos look legitimate. Many use the same tone and layout as real how-to tech content, but behind the scenes, they’re designed to take control of your device and your data.

How the scam works

• A TikTok creator posts a short “activation” video claiming to unlock expensive software for free.
• The video includes a simple “step-by-step” guide that encourages viewers to follow along on their own computer.
• Once viewers download or click what they think is a harmless tool, malware silently installs in the background, giving hackers access to saved passwords, private accounts, and even payment information.

The scam works because it blends the look and feel of ordinary TikTok tutorials with social proof, think comments, hashtags, and even fake success stories, that make it seem credible.

Security researchers say the same technique has been spotted in similar scams spreading via fake CAPTCHA pages and cracked game downloads. The goal is always the same: convince users to “verify,” “activate,” or “fix” something, when in reality, they’re opening the door to attackers.

What McAfee’s Researchers Have Found

McAfee Labs has been tracking a related wave of attacks using fake CAPTCHA pages and cracked download sites to deliver info-stealing malware. In both campaigns, scammers prey on everyday habits such as downloading software, clicking “I’m not a robot,” or following quick tech fixes that seem safe.

Our researchers found that these scams spread through multiple channels, including phishing emails and fake support sites, all designed to look familiar. The end result is the same: stolen credentials, compromised devices, and exposed personal information.

These patterns mirror the rise of TikTok-based scams reported by Bleeping Computer. The methods may evolve, but the psychology is the same: social engineering that turns trust into a weapon.

How to Protect Yourself

1. If it sounds too good to be true, it is. There are no free unlocks for paid apps or streaming services.
2. Don’t follow tech “hacks” from unknown creators. Even if they have thousands of views, scammers can fake credibility.
3. Use official download sources. Only get software and updates directly from verified developer sites.
4. Watch for red flags. Phrases like “free activation,” “pro version unlock,” or “verify you’re human” are often scam signals.
5. Use trusted security protection. Security software that spots scams before they spread can help block malicious links and videos automatically.

The bigger picture

Scammers are getting smarter about how they reach people. They’re blending into everyday content like short-form videos, social challenges, and viral tips. Then they’re using those moments of distraction to plant malware.

Tools like McAfee’s built-in Scam Detector, included in all core plans, are designed to spot this new kind of threat early. It automatically detects scams across text, email, and video, blocks dangerous links, and even identifies AI-manipulated content like deepfakes, helping stop harm before it happens.

As scammers adapt, your best defense is awareness and technology that adapts just as fast.

Introducing McAfee+

Identity theft protection and privacy for your digital life.

Download McAfee+ Now