TikTok for Business accounts targeted in new phishing campaign
Recorded: March 26, 2026, 3:26 p.m.
| Original | Summarized |
TikTok for Business accounts targeted in new phishing campaign News Featured Popular LiteLLM PyPI package backdoored to steal credentials, auth tokens HackerOne discloses employee data breach after Navia hack Firefox now has a free built-in VPN with 50GB monthly data limit Infinite Campus warns of breach after ShinyHunters claims data theft TikTok for Business accounts targeted in new phishing campaign WhatsApp rolls out more AI features, iOS multi-account support Inside a Modern Fraud Attack: From Bot Signups to Account Takeovers Coruna iOS exploit framework linked to Triangulation attacks Tutorials Latest How to access the Dark Web using the Tor Browser How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11 How to use the Windows Registry Editor How to backup and restore the Windows Registry How to start Windows in Safe Mode How to remove a Trojan, Virus, Worm, or other Malware How to show hidden files in Windows 7 How to see hidden files in Windows Webinars Latest Qualys BrowserCheck STOPDecrypter AuroraDecrypter FilesLockerDecrypter AdwCleaner ComboFix RKill Junkware Removal Tool Deals Categories eLearning IT Certification Courses Gear + Gadgets Security VPNs Popular Best VPNs How to change IP address Access the dark web safely Best VPN for YouTube Forums Virus Removal Guides HomeNewsSecurityTikTok for Business accounts targeted in new phishing campaign TikTok for Business accounts targeted in new phishing campaign By Bill Toulas March 26, 2026 Threat actors are targeting TikTok for Business accounts in a phishing campaign that prevents security bots from analyzing malicious pages. Collecting basic information in a first validation stepSource: Push Security The TikTok themed (top) and Google (bottom) phishing pagesSource: Push Security Red Report 2026: Why Ransomware Encryption Dropped 38% Related Articles: Account Takeover Bill Toulas Previous Article Post a Comment Community Rules You need to login in order to post a comment You may also like: Popular Stories Popular LiteLLM PyPI package backdoored to steal credentials, auth tokens New KB5085516 emergency update fixes Microsoft account sign-in Microsoft Exchange Online service change causes email access issues Sponsor Posts Synthetic Identities, Proxies & Real Identities for Sale, is yours next? Are your AI accounts being sold on the dark web? Check for free. AI is a data-breach time bomb: Read the new report Overdue a password health-check? Audit your Active Directory for free Cyber resilience without the complexity. Join Zero Networks to stop lateral movement fast. Upcoming Webinar Follow us: Main Sections News Community Forums Useful Resources Welcome Guide Company About BleepingComputer Terms of Use - Privacy Policy - Ethics Statement - Affiliate Disclosure Copyright @ 2003 - 2026 Bleeping Computer® LLC - All Rights Reserved Login Username Password Remember Me Sign in anonymously Sign in with Twitter Not a member yet? Register Now Help us understand the problem. What is going on with this comment? Spam Abusive or Harmful Inappropriate content Strong language Other Read our posting guidelinese to learn what content is prohibited. Submitting... |
This document details a concerning phishing campaign targeting TikTok for Business accounts, orchestrated by threat actors seeking to compromise credentials and potentially spread malicious content. Push Security identified a coordinated effort leveraging deceptive websites mimicking legitimate TikTok and Google Career pages to harvest user information. The campaign’s effectiveness stems from the high value of TikTok for Business accounts – frequently used for malvertising, ad fraud, and the dissemination of harmful content – combined with the platform’s reach and perceived legitimacy. The initial stage of the attack involves redirection through Cloudflare Turnstile, a security mechanism designed to mitigate bot traffic, highlighting a sophisticated understanding of common security protocols. Victims are directed to domain names closely resembling those of TikTok and Google Careers, prompting them to complete a form requesting basic email verification. This serves as an initial validation step, designed to collect data for subsequent exploitation. Following this, the victims are presented with a reverse proxy login page, engineered to capture credentials and session cookies. Crucially, the attack bypasses standard two-factor authentication (2FA) protections due to the intermediary nature of the proxy. A significant vulnerability lies in the widespread use of Google Single Sign-On (SSO) for accessing TikTok accounts. This single point of entry allows the threat actor to compromise both the TikTok and Google accounts concurrently, substantially amplifying the potential damage. The threat actors utilize domains registered through NiceNIC, a registrar frequently associated with malicious activity, demonstrating a deliberate selection of infrastructure known for facilitating cybercriminal operations. The sophisticated design of the phishing pages, mimicking legitimate interfaces, further increases the likelihood of successful deception. Push Security’s report underscores a concerning trend: the exploitation of seemingly legitimate platforms like TikTok for Business to facilitate malicious activities. The attackers’ strategy reflects a broader pattern observed by Sublime Security, utilizing similar techniques in targeting Google Ad Manager accounts. The campaign’s success demonstrates a tactic that can be readily deployed against high-value targets, emphasizing the importance of vigilance and robust security measures. Recommendations include heightened caution when engaging with unsolicited invitations or job offers, a critical evaluation of all links before clicking, and the implementation of security measures such as passkeys to safeguard accounts against compromise, particularly given the inherent risks associated with SSO integrations. The campaign’s deliberate use of Google Storage for hosting reinforces the importance of thorough security audits of cloud infrastructure and the need for organizations to maintain a proactive approach to threat detection and response. |