Cybercriminals are targeting TikTok Business profiles in a credential-phishing scheme that bypasses security bot detection.

TikTok Business accounts are attractive targets due to their potential misuse for malicious advertising, ad fraud, and spreading harmful content.

Push Security, a browser security firm, says this campaign is related to a similar one from last year targeting Google Ad Manager accounts.

TikTok has previously been exploited to distribute malware that steals information through deceptive videos, and to promote cryptocurrency scams using bogus promotions. TikTok Business accounts offer greater reach and credibility, making them well-suited for these scams.

According to a report Push Security shared with BleepingComputer, victims are lured to phishing pages hosted on Cloudflare and registered on March 24 through NiceNIC, a registrar known for being used in cybercrime reported by cybersecurity researchers.

While Push Security hasn’t determined how the phishing links are initially spread, they suspect the attackers are using a similar technique to one reported by Sublime Security.

The initial link redirects through a legitimate Google Storage URL, uses a Cloudflare Turnstile check to block bots, and then redirects to the fake pages.

The domains have similar names and are all hosted on the same Google Storage bucket:

• welcome.careerscrews[.]com
• welcome.careerstaffer[.]com
• welcome.careersworkflow[.]com
• welcome.careerstransform[.]com
• welcome.careersupskill[.]com
• welcome.careerssuccess[.]com
• welcome.careersstaffgrid[.]com
• welcome.careersprogress[.]com
• welcome.careersgrower[.]com
• welcome.careersengage[.]com
• welcome.careerscrews[.]com

These fraudulent pages mimic TikTok for Business and Google Careers “Schedule a Call” pages, prompting users to enter personal data in a form to confirm they have a business email address.

Following this step, victims are presented with a deceptive login page that functions as a reverse proxy to steal login credentials and session cookies, sending them to the attackers.

Because the page intercepts traffic between the user and the actual service, the attacker can take over accounts even with two-factor authentication (2FA) enabled.

Push Security also points out that business account owners frequently use Google single sign-on (SSO) to access TikTok. “This means if Google is used for TikTok logins, both accounts are compromised and can be used to distribute ads.”

Be wary of unsolicited invitations and job offers, and never click links from unknown sources. Always verify the domain before entering any login credentials and use passkeys on important accounts for added protection.