“Adult TikTok” Search Lures Drive Scam Funnels

Malwarebytes · Low sophistication
Last updated August 3, 2026

Scammers are using fake webpages that appear in search results for “TikTok” plus adult terms, promising “exclusive” explicit videos. Instead of any real content, the pages push visitors into an ad/affiliate funnel that collects emails, payment cards for fake “age verification,” or tricks people into installing apps outside official stores.

Key findings

  • Scam pages exploit TikTok’s name to attract search traffic for adult-content queries, but are not connected to TikTok.
  • The lure is a fake promise of “an endless feed of explicit clips, no signup required,” using blurred thumbnails and “18+ only” labels.
  • Victims are funneled into redirects/ads, asked for an email, asked for a payment card for fake “age verification,” or prompted to install apps from outside official app stores.
  • “Age verification” payment-card collection can lead to recurring subscription charges.
  • Embarrassment reduces reporting and makes the lure more effective.

Who’s being targeted

  • Commonly targeted roles: All employees, Finance (corporate card holders), Mobile device users.
  • Affected industries: Consumers / General public.
  • Attack channels: website.
  • Impersonated: A fake “TikTok adult content” site (not actually TikTok), An “age verification” page for adult content access, A “video player” or “content access” app promoted by the lure page.

Awareness takeaways

  • Treat “exclusive content” search-result pages as high-risk; close the tab instead of clicking through.
  • Never enter your email or other personal details just to access content, assume it will be used for spam/phishing.
  • Do not provide payment card details for “age verification,” especially when it’s just a gate to a promised video.
  • Only install apps from official app stores and be suspicious of sites that push downloads to view content.

Red flags to watch for

  • Promises explicit/“exclusive” content with a blurred thumbnail and repeated gating clicks
  • Pushes you to sign up even though it claims “no signup required”
  • Redirects through ad networks instead of showing content
  • Requests payment card details for simple age verification
  • Fine print/quiet enrollment into recurring subscriptions
  • Content never appears; the process is all gating and data collection
  • Software offered outside official app stores
  • Content is always “one click away,” but never delivered
  • Unclear publisher/permissions and aggressive prompts to install
Try Mirage

Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.

Get a demo
Read the video transcript

You search “TikTok” plus an adult term, tap a result, and it promises an endless feed of explicit clips, no signup required. But on the other side of that click is an ad funnel dressed up as exclusive content: a fake TikTok-style page with a blurred thumbnail, big 18+ label, and buttons saying Start watching or Sign up for free. Click again and you’re bounced through ads, then hit with an “age verification” page asking for your email and a payment card to prove you’re over 18, fine print hides recurring subscription charges, and the video never actually appears. Here’s the move: if a “TikTok adult” page wants your email, card, or an app download just to start watching, don’t argue with it, close the tab and walk away.

Similar attacks

Fake TikTok Shop Sites Mimic Badges to Steal Pay

Fake TikTok Shop Sites Mimic Badges to Steal Pay

Scammers are setting up lookalike websites that copy TikTok Shop’s design, trust badges, and wording to trick people into thinking they’re shopping inside TikTok. The main risk is entering payment (and sometimes loan-application) details into a site that has no real connection to TikTok, leading to…

August 11, 2026
Revolut Smishing Uses Fake Identity Check

Revolut Smishing Uses Fake Identity Check

Following a Revolut data breach, scammers sent text messages that appeared to come from the same message thread as legitimate Revolut texts. The texts pushed victims to click a link for a fake identity “liveness check,” request camera access, and then capture passwords, information that could be…

September 21, 2026
Fake bpost Customs Fee Scam Steals Bank Details

Fake bpost Customs Fee Scam Steals Bank Details

A real phishing campaign impersonated postal couriers (including Belgium’s bpost) to trick people into paying a small “customs fee” for an undelivered parcel. Victims were sent to a fake courier website that collected personal details, then escalated to stealing full card and banking (IBAN)…

September 18, 2026
Revolut Users Hit With SMS Phish After Breach

Revolut Users Hit With SMS Phish After Breach

Days after Revolut disclosed that customer records were shared with an unauthorized party, some customers reported receiving phishing texts that appeared in the same SMS thread as real Revolut messages. The link led to a fake site that asked for camera access to mimic Revolut’s identity “liveness”…

September 17, 2026
Fake T-Mobile Points Expiry Texts Hit Phones

Fake T-Mobile Points Expiry Texts Hit Phones

A large phishing (smishing) campaign is sending messages that claim a T-Mobile customer’s rewards points are about to expire. The texts use urgency, made-up point balances, and lookalike “t-mobile.*.top” links to push people into clicking and entering sensitive information. Malwarebytes observed…

September 17, 2026
Brevo Breach Fuels Crypto Newsletter Phishing

Brevo Breach Fuels Crypto Newsletter Phishing

Attackers abused access to Brevo (an email marketing platform) to send highly convincing phishing emails from legitimate cryptocurrency company domains to newsletter subscribers. The lures claimed urgent security issues (hardware vulnerability or data breach) and pushed victims to click links,…

September 11, 2026