Scammers are creating TikTok-branded “rewards” websites that promise big cash payouts for simple actions like daily check-ins and small tasks. The sites show large balances and use countdown timers to rush users, but when users try to withdraw, the site keeps adding new requirements (referrals, offers, or downloading an app). The goal is to harvest personal/banking details or drive installs and clicks that make the scammer money, without ever paying out.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You land on a TikTok-looking rewards page saying, “Welcome back, your balance is about to expire.” And it shows you hundreds of dollars. You do the daily check-ins, hit the tasks, the balance keeps climbing. But when you tap withdraw, it always wants one more thing, refer friends, complete offers, or download an app to “verify” your identity. Here’s the trap: those on-screen dollars and timers are just graphics. Nothing on these pages reflects a real ledger, but they’ll happily take your banking details or push you to install adware. If a TikTok “rewards” site is outside the real TikTok app and wants extra tasks or your bank info to unlock cash, kill the tab. Don’t chase the payout.
Scammers are setting up lookalike websites that copy TikTok Shop’s design, trust badges, and wording to trick people into thinking they’re shopping inside TikTok. The main risk is entering payment (and sometimes loan-application) details into a site that has no real connection to TikTok, leading to…
Scammers are using fake webpages that appear in search results for “TikTok” plus adult terms, promising “exclusive” explicit videos. Instead of any real content, the pages push visitors into an ad/affiliate funnel that collects emails, payment cards for fake “age verification,” or tricks people…
Scammers are setting up fake Fortnite “rewards,” “locker value,” and “competition” websites that funnel players to a fake Epic Games login page. The sites trick people into signing in so attackers can steal Epic usernames and passwords, then take over accounts for resale, fraud, or further scams. A…
Cofense reports a sustained rise in real phishing campaigns disguised as party/event invitations that trick people into clicking links. The same invitation lure is being used both to steal usernames/passwords via fake login pages and to install legitimate-but-abused remote access tools that give…
Researchers found a turnkey scam kit sold on a cybercrime forum that lets criminals quickly stand up a fake crypto “presale” website styled to look like Tesla. The site uses pressure tactics and a fake investment dashboard to trick people into either handing over their wallet recovery phrase or…
A scam campaign uses full-screen browser popups impersonating Apple Support or Amazon to claim an “unauthorized” $149.99 charge and pressure victims to call a phone number. Callers reach a live scammer posing as support who tries to gain remote access or steal payment/account details, sometimes…
