Hackers are always coming up with clever ways to exploit the latest trends, the latest example being using the popular TikTok challenge to trick unsuspecting users into installing malware on their devices.

If you are not already familiar with TikTok's Invisible Challenge (opens in a new tab), it involves applying an Invisible Body filter that uses the body's skin tone as a green screen. If your video has a neutral-colored background and the filter is enabled, it can make the body appear almost invisible, except for a silhouette around the outline of the body.

Invisible body filters have been available on TikTok for several years, and some content creators have begun using them to hide their bodies during nude shoots. As you can imagine, some have begun to wonder if it is possible to remove the filter and see what is hidden beneath it.

Hackers quickly jumped on this idea, and according to BleepingComputer (opens in new tab), they have now begun offering special "unfilter" software to remove the original filter. However, this software is completely fake, and instead of removing the invisible body filter from TikTok videos, it actually installs WASP stealer malware that steals passwords, accounts, and even cryptocurrency.

According to a new report (opens in new tab) from cybersecurity firm Checkmarx, two TikTok users posted videos on the platform with over a million views to promote an app that can remove invisible body filters. They also included a link to a Discord server called "Space Unfilter" where the app can be downloaded in their bios on the platform.

When users click on the link and join the Space Unfilter Discord server, they are presented with NSFW videos uploaded by the hackers behind this campaign. In addition, a private message is automatically sent by a bot account called "Nadeko" asking the user to star the GitHub repository where the malicious app is hosted.

These private messages seem to have served their purpose, as the repository (where all the project's files are stored) quickly became a trending project on GitHub. Once downloaded to a victim's smartphone or computer, a script in the repository installs a malicious Python package containing the WASP Stellar malware.

At this point, the campaign appears to be still ongoing; as Checkmarx points out in its report, every time the Python security team removes a hacker's malicious package, they improvise and use a different name. Fortunately, however, the Unfilter Space Discord server is offline and the GitHub repository has been replaced with a "Nitro generator" file.

Hackers and other cybercriminals love to take advantage of fads, especially crisis fads. Such was the case with Queen Elizabeth II earlier this year and the fake cure for the coronavirus in early 2020. This is why you should always be careful when clicking on links, whether on social media or in your inbox. [Having your personal information stolen or your device infected with malware is not worth the risk. To avoid becoming a victim of this type of fraud, one must be aware of incorrect spelling and poor grammar. At the same time, one should avoid opening messages or e-mails from unknown senders, especially those with blank subject lines.

Installing one of the best anti-virus software suites on your computer and one of the best Android anti-virus apps on your smartphone can help prevent your device from being infected with malware, but cybercriminals still phishing to hijack accounts through If a website or app asks you to log in even though you are already logged in, that could be a sign that you are on a phishing page.

As for TikTok's Invisible Challenge, you should never take videos or photos that you don't want others to see in the first place. Even if you use filters, exposing yourself on the internet could cause you pain in the future.