TikTok scammers tried hacking 125 targets that followed famous accounts, researchers find

How many accounts the attackers breached remains unclear.

More than 125 people and businesses associated with large TikTok accounts based around the world were targeted as part of a recent phishing campaign, according to research published Tuesday.

Emails warned that targeted accounts were either in danger of being deleted for copyright violations or eligible for a verification badge. If victims replied to a message, attackers directed them to click a link to a WhatsApp chat, where a purported TikTok representative would confirm their accounts.

While it remains unclear if any accounts were breached, the campaign is the latest to demonstrate how TikTok’s popularity makes its most visible users targets for scammers.

In addition to individual account holders, the latest campaign targeted talent agencies, brand-consultant firms, social media production studios, influencer management firms, according to Rachelle Chouinard, a threat intelligence analyst at email security firm Abnormal Security, which shared its findings with CyberScoop. Crane Hassold, the director of threat intelligence at Abnormal, declined to share the specific names of the people and accounts targeted, but said the accounts in question had “millions to tens of millions of followers.”

In two batches of emails — sent Oct. 2 and Nov. 1 — the victim was told that material posted to their account violated copyright laws, or promised they would receive verified badge, which confers both legitimacy and status to popular accounts on the platform. If the victim replied to the email as instructed, a second email with a “Confirm My Account” link redirected to a WhatsApp chat, where they would be asked to “verify” the phone number and email associated with the account. A six-digit number made to look like a two-factor authentication code was then sent to the victim’s phone.

Exactly who was behaind the effort remains unclear, as does their ultimate intention. Fraudsters frequently direct potential victims off social media channels and into conversation chats, such as WhatsApp or Google Hangouts, where they then send malicious links or request personal information.

“At the end of the day they were trying to hijack these TikTok accounts for some purpose,” said Hassold.

TikTok, owned by the Chinese based firm ByteDance, has more than 1 billion monthly users the company announced in September, marking a 45% increase since July 2020, Reuters reported at the time. Its rapid rise facilitates more than $100 million of monthly user spending, and reportedly generates large sums for account holders with massive followings.

A TikTok spokesperson did not answer questions about the campaign in question before press time, urging users to adopt two-factor authentication and to use strong passwords.

“TikTok is committed to maintaining a positive and safe environment for our global community,” the spokesperson said.

Social media account hijacks aren’t new. Google’s in October announced the recovery of roughly 4,000 YouTube channels that were stolen through fake content collaboration offers. In July 2020, attackers took over more than 100 prominent Twitter accounts as part of a plot to generate cryptocurrency.

Prominent people are directly targeted as well, such as in October when an Irish broadcaster had her Instagram account hijacked and held for ransom.

The phishing emails had some obvious red flags. Scammers sent the messages from Gmail accounts, displayed poor command of the English language, and grouped victim email addresses were all grouped together in the “To” message field, allowing the researchers to see that 86 victims were targeted on Oct. 2 and 45 more on Nov. 1.

“While we do see a number of more sophisticated social engineering attacks, this is probably in the majority of attacks we see on a daily basis,” Hassold said.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure