![Wanted: Suspect for Homicide in the 12th District [VIDEO]](https://thephillypi.com/wp-content/uploads/2026/03/1774941501_Wanted-Suspect-for-Homicide-in-the-12th-District-VIDEO-330x220.jpg "Wanted: Suspect for Homicide in the 12th District [VIDEO]")
A new AITM phishing campaign targets TikTok Business accounts to hijack them for malvertising, continuing tactics seen in earlier Google-themed scams.
Push Security researchers uncovered a new wave of AITM phishing pages targeting TikTok for Business accounts, aiming to hijack them for malvertising. The campaign includes TikTok and Google-themed fake pages, showing links to previous operations. Once compromised, accounts are used to run malicious ads, steal credentials, spread malware, and conduct ad fraud, diverting company advertising budgets for profit.
Attackers used newly registered domains created within seconds and hosted behind Cloudflare. The pages follow a common naming pattern and redirect victims from legitimate services before loading fake TikTok for Business or Google “Schedule a call” pages.
Users are asked to fill in basic details, then shown a malicious login page powered by an AITM phishing kit. The campaign uses bot protection to evade detection and likely spreads via targeted emails, similar to past operations.
“When the link is first clicked, the page is silently redirected from a legitimate Google Storage site before loading the page.” reads the report published by Push Security. “A Cloudflare Turnstile check is used to prevent security bots from analyzing the page, before loading either a TikTok or Google themed page. Progressing through the forms ultimately serves up an AITM phishing page.”
EXPLORE MORE
More details on Jesús Luzardo’s contract extension – Phillies Nation
The Phillies on Tuesday made Jesús Luzardo’s five-year contract extension official. The…
The Silent Wingman: How Fox3 Managed Solutions is Rewriting the Flight Sim Server Playbook
If you’ve spent any time in the virtual skies of Digital Combat…
Star Fox Who? Wild Blue Skies is the 90s Revival We Actually Deserve
If your childhood thumb-callouses were earned steering an Arwing through Corneria or…
The European Commission confirmed a cyberattack affecting part of its cloud systems
The European Commission confirmed a cyberattack affecting part of its cloud systems,…
Satellite Reveal: Precision Strikes Gut Shokuhiye Industrial Zone
New low-resolution satellite imagery has exposed the aftermath of a sustained air…
Philadelphia Police Seek Public’s Help to Identify Critically Injured Pedestrian
The Philadelphia Police Department is requesting the public’s assistance in identifying a…
By combining trusted branding, redirects, and layered deception, attackers increase success rates and harvest credentials for further abuse, including account takeover and fraud.
While phishing campaigns usually mimic platforms like Google or Microsoft, targeting TikTok is becoming more common.
The platform has long been used to spread malicious links and social engineering content, including videos that trick users into installing infostealers like Vidar or StealC. It is also widely abused for crypto scams and direct attacks via messages. Gaining access to TikTok business accounts is especially valuable, as they can be used for malvertising and fraud.
Many users log in via Google, meaning a single compromise can expose both TikTok and Google accounts, enabling broader abuse such as ad fraud, data theft, and access to other connected services.
The report also includes Indicators of Compromise (IoCs) for this campaign.
“Short-lived IoCs are of limited value when tackling modern phishing attacks due to the rate at which attackers are able to quickly spin up and rotate the sites used in the attack chain, often dynamically serving different URLs to site visitors.” concludes the report.
