Fraud - AitM Phishing Campaign Targets TikTok Business Accounts

What Happened

Threat actors have launched a new adversary-in-the-middle (AitM) phishing campaign targeting TikTok for Business accounts. According to a report from Push Security, these accounts are particularly appealing to cybercriminals because they can be exploited for malvertising and distributing malware. The campaign tricks victims into clicking malicious links that lead to fake TikTok or Google Careers pages.

This phishing scheme is not entirely new. A similar campaign was flagged by Sublime Security in October 2025. The attackers use social engineering tactics, including emails masquerading as outreach messages, to lure victims. Once users interact with these deceptive pages, the attackers aim to perform a Cloudflare Turnstile check to block automated scanners, ensuring that only human victims reach the malicious login page designed to harvest credentials.

Who's Being Targeted

The primary targets of this phishing campaign are businesses using TikTok for marketing and engagement. These accounts often have access to valuable data and resources, making them prime candidates for exploitation. By gaining control of these accounts, attackers can engage in malvertising, which involves promoting harmful content or distributing malware to unsuspecting users.

The campaign has been noted for its sophistication, utilizing AI-generated videos that mimic legitimate activation guides for popular applications like Windows and Spotify. This level of deception increases the likelihood that victims will fall for the scam, ultimately leading to compromised accounts.

Signs of Infection

Victims may notice several signs that indicate they have been targeted by this phishing campaign. Common indicators include:

• Receiving unexpected emails or messages prompting them to log in to TikTok or Google Careers.
• Encountering unfamiliar login pages that look similar to legitimate sites.
• Unusual activity on their TikTok for Business accounts, such as unauthorized posts or changes in account settings.

If you suspect that you have interacted with a phishing page, it’s crucial to act quickly to secure your account. Change your passwords and enable two-factor authentication to add an extra layer of protection.

How to Protect Yourself

To safeguard against this AitM phishing threat, consider the following measures:

• Be cautious with links: Avoid clicking on links in unsolicited emails or messages, especially those that ask for login credentials.
• Verify the source: Always check the sender's email address and look for signs of phishing, such as misspellings or unusual domain names.
• Use security tools: Employ browser extensions or security software that can help detect and block phishing attempts.
• Educate your team: Ensure that everyone involved with your TikTok for Business account understands the risks and knows how to recognize phishing attempts.

By staying vigilant and informed, you can significantly reduce the risk of falling victim to this evolving phishing threat.