Phishing Campaign Targets TikTok for Business Accounts
Summary
Push Security reports a campaign targeting TikTok for Business with bot-screening checks and reverse-proxy phishing pages that steal credentials and session cookies, potentially bypassing 2FA. The initial delivery method is unknown.
Key points
- Push Security reports that the campaign targets TikTok for Business accounts, which could be abused for malvertising, ad fraud, or spreading malicious content.
- Initial links redirect through a Google Storage URL, then use Cloudflare Turnstile checks to block bots before reaching phishing pages.
- The pages impersonate TikTok for Business and Google Careers and use a reverse proxy to capture credentials and session cookies.
- The reverse-proxy technique can enable account takeover even when two-factor authentication is active.
- Push Security says many business users sign in to TikTok through Google SSO, potentially putting both accounts at risk.
- The report says the initial delivery mechanism could not be determined; users are advised to check domains, avoid suspicious links, and use passkeys.
Article Details
- Event Type
- Phishing campaign targeting TikTok for Business accounts
- Impact
- The reverse-proxy phishing pages are designed to capture credentials and session cookies, potentially enabling account takeover even when 2FA is active. Push Security says users signing in to TikTok through Google SSO could also have their Google accounts compromised. The accounts could then be used for malvertising, ad fraud, or distributing malicious content; the article does not confirm that accounts were successfully compromised.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| HOSTNAME | welcome[.]careerscrews[.]com | Identified as a malicious phishing hostname used to impersonate TikTok for Business and Google Careers. |
| HOSTNAME | welcome[.]careersengage[.]com | Identified as a malicious phishing hostname used to impersonate TikTok for Business and Google Careers. |
| HOSTNAME | welcome[.]careersgrower[.]com | Identified as a malicious phishing hostname used to impersonate TikTok for Business and Google Careers. |
| HOSTNAME | welcome[.]careersprogress[.]com | Identified as a malicious phishing hostname used to impersonate TikTok for Business and Google Careers. |
| HOSTNAME | welcome[.]careersstaffgrid[.]com | Identified as a malicious phishing hostname used to impersonate TikTok for Business and Google Careers. |
| HOSTNAME | welcome[.]careerssuccess[.]com | Identified as a malicious phishing hostname used to impersonate TikTok for Business and Google Careers. |
| HOSTNAME | welcome[.]careerstaffer[.]com | Identified as a malicious phishing hostname used to impersonate TikTok for Business and Google Careers. |
| HOSTNAME | welcome[.]careerstransform[.]com | Identified as a malicious phishing hostname used to impersonate TikTok for Business and Google Careers. |
| HOSTNAME | welcome[.]careersupskill[.]com | Identified as a malicious phishing hostname used to impersonate TikTok for Business and Google Careers. |
| HOSTNAME | welcome[.]careersworkflow[.]com | Identified as a malicious phishing hostname used to impersonate TikTok for Business and Google Careers. |
MITRE ATT&CK
Vendors
CloudflareThreat actors are targeting TikTok for Business accounts with a phishing campaign that uses Cloudflare Turnstile checks and Google Storage-hosted pages to evade security bots.GoogleThreat actors are targeting TikTok for Business accounts with a phishing campaign that uses Cloudflare Turnstile checks and Google Storage-hosted pages to evade security bots.TikTokThreat actors are targeting TikTok for Business accounts with a phishing campaign that uses Cloudflare Turnstile checks and Google Storage-hosted pages to evade security bots.
Products
Cloudflare TurnstileThreat actors are targeting TikTok for Business accounts with a phishing campaign that uses Cloudflare Turnstile checks and Google Storage-hosted pages to evade security bots.TikTok for BusinessThreat actors are targeting TikTok for Business accounts with a phishing campaign that uses Cloudflare Turnstile checks and Google Storage-hosted pages to evade security bots.