Phishing Campaign Targets TikTok Business Accounts

Security researchers at Push Security have identified a sophisticated phishing campaign targeting TikTok for Business accounts, using adversary-in-the-middle techniques to steal credentials and hijack accounts for malicious advertising and fraud.

The campaign, which surfaced in late March, involves a cluster of phishing pages registered on March 24 through Nicenic International Group, a registrar frequently associated with bulk phishing operations. These domains, hosted behind Cloudflare, follow a consistent naming pattern derived from variations of "welcome.careers.com." Researchers expect the list of malicious domains to expand as the effort continues.

Victims are typically lured via targeted emails containing suspicious links, a method similar to a prior campaign documented by Sublime Security in October. Upon clicking, the link redirects users through a legitimate Google Cloud Storage URL to build trust before loading the fake page. A Cloudflare Turnstile verification step then blocks security bots and automated scanners, allowing the site to present either a TikTok for Business landing page or a Google Careers page disguised as a job opportunity with a "schedule a call" option.