Global TikTok scam uses fake shops and malware to steal money and data

FraudOnTok is a new worldwide scam targeting TikTok Shop users. Using fake websites and mobile apps, AI-generated content lures users into believing that they’re interacting with the real TikTok Shop platform – only to steal their personal information, drain crypto wallets, and infect their devices with spyware.

It all starts with a fake, yet convincing platform. Cybercriminals behind FraudOnTok mimic the TikTok Shop so well that many users believe they’re either on TikTok Shop, TikTok Mall, or TikTok Wholesale. Altogether, that’s more than 15,000 impersonated websites.

The majority of these websites include authentic-looking branding, logos, and even fake product reviews. As eye-catching as these websites are, so are the ads that are promoted on Facebook, TikTok, WhatsApp, and Telegram. Most of the time, they portray real influencers or brand ambassadors who are promoting products or offering discounts that are too good to be true. The discounts, as well as the people in the videos, are fake.

When a victim clicks on these ads, they’re directed to a replica of TikTok Shop. Then, they’re asked to either enter their login credentials or download a mobile app that looks exactly like TikTok’s. The latter turns out to actually be a trojan – a modified version of TikTok loaded with spyware, cybersecurity company CTM360 reports.

The victims who fall for this scam are both potential buyers and content creators.

After being installed, the fake TikTok app works just fine, almost as well as the original. However, in reality, the spyware called SparkKitty collects data and communicates with attacker-controlled servers.

When users try to log in, the app makes it look as if they have typed in the wrong email address or password. As a result, the app suggests logging in via Google because Google’s OAuth system grants attackers a token that can sometimes bypass standard login protections. This allows attackers to hijack accounts without needing to verify credentials through traditional channels.

Scammers not only hijack accounts but also crypto

The scam is also designed to steal money, especially cryptocurrency. Many fake TikTok Shop sites encourage “buyers” to make payments using Tether or other hard-to-trace digital currencies. Researchers from CTM360 point out that these types of transactions are often made for products that don’t exist or for commissions that will never be paid.

Affiliate participants are also targeted. Victims can see fake earnings dashboards and receive messages saying they need to top up their account to withdraw what’s earned. Of course, the money is not real, and the top-ups go straight into the scammers’ wallets.

This trick is dangerous not only because it lures out victims' money but also because it keeps them in a loop in which fake “successful” metrics trigger people into imagining they’re actually gaining profit, thus manipulating them into sending even more money.

FraudOnTok reaches further than TikTok itself

Even though TikTok Shop officially operates in only 17 countries, the FraudOnTok campaign targets all users in countries where TikTok is used. This gives greater potential to attract more victims.

CTM360 emphasizes that the scam is evolving, with attackers continuously updating their tactics, lures, and content. By using familiar branding and AI-generated visuals, they’re able to stay one step ahead of many traditional security measures.

How to avoid falling for this scam

• The above-mentioned websites use cheap extensions such as .shop, .top, and .icu. Scammers use them to scale up their “business” faster and cheaper. However, the extensions are a red flag to look out for if you visit a site that is too good to be true.
• Once logged in to the fake TikTok app, all users see a TikTok Shop dashboard regardless of whether they have a business or creator account. If you don’t own a business or create content, chances are the dashboard is fake and designed to scam you.

• Unbelievably good deals, especially those promoted by ads or through DMs, are more likely to be scams.
• Apps that are downloaded not from official app stores, however realistic they may look, are more likely to be scams, too.