Scammers are creating TikTok-branded “rewards” websites that promise big cash payouts for simple actions like daily check-ins and small tasks. The sites show large balances and use countdown timers to rush users, but when users try to withdraw, the site keeps adding new requirements (referrals, offers, or downloading an app). The goal is to harvest personal/banking details or drive installs and clicks that make the scammer money, without ever paying out.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You land on a TikTok-looking rewards page saying, “Welcome back, your balance is about to expire.” And it shows you hundreds of dollars. You do the daily check-ins, hit the tasks, the balance keeps climbing. But when you tap withdraw, it always wants one more thing, refer friends, complete offers, or download an app to “verify” your identity. Here’s the trap: those on-screen dollars and timers are just graphics. Nothing on these pages reflects a real ledger, but they’ll happily take your banking details or push you to install adware. If a TikTok “rewards” site is outside the real TikTok app and wants extra tasks or your bank info to unlock cash, kill the tab. Don’t chase the payout.
Scammers are setting up lookalike websites that copy TikTok Shop’s design, trust badges, and wording to trick people into thinking they’re shopping inside TikTok. The main risk is entering payment (and sometimes loan-application) details into a site that has no real connection to TikTok, leading to…
Scammers are using fake webpages that appear in search results for “TikTok” plus adult terms, promising “exclusive” explicit videos. Instead of any real content, the pages push visitors into an ad/affiliate funnel that collects emails, payment cards for fake “age verification,” or tricks people…
Researchers found a real phishing campaign offering a “free” Claude Max upgrade to trick people into signing in with Google. The site uses a fake, draggable Google login pop-up (“browser-in-the-browser”) that looks legitimate and captures credentials. A stolen Google account can expose email and…
Researchers found a phishing campaign offering a “free” upgrade to Claude Max to trick people into signing in with Google. The page uses a convincing fake, draggable Google login window (“browser-in-the-browser”) to capture credentials, potentially giving criminals access to email, documents, and…
Researchers found a network of 100+ polished look‑alike subscription websites that impersonate real products (and invent new ones) to sell expensive “AI” plans. The sites rely on professional landing pages and a real Google sign-in flow to appear legitimate, then steer visitors into paid…
A large phishing (smishing) campaign is sending messages that claim a T-Mobile customer’s rewards points are about to expire. The texts use urgency, made-up point balances, and lookalike “t-mobile.*.top” links to push people into clicking and entering sensitive information. Malwarebytes observed…
