Scammers are setting up lookalike websites that copy TikTok Shop’s design, trust badges, and wording to trick people into thinking they’re shopping inside TikTok. The main risk is entering payment (and sometimes loan-application) details into a site that has no real connection to TikTok, leading to fraud, identity theft, or stolen card data.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
If a shopping site looks like TikTok Shop, but you didn’t open it from inside the TikTok app, hit pause. Scam sites are copying TikTok Shop’s look, its category layout, and even fake trust badges like “trusted sellers” and “secure service” to make you think you’re still inside TikTok, right up until checkout. The real danger is the checkout. One version just wants your card details for non-delivery and resale. Another pushes a “Wholesale TikTok Shop” with a built‑in loan service, asking for ID documents and banking info, perfect for identity theft. Your move: only use TikTok Shop from inside the official TikTok app. If you got there from an ad, DM, or search result in a browser, back out, don’t enter payment or loan details.
Scammers are using fake webpages that appear in search results for “TikTok” plus adult terms, promising “exclusive” explicit videos. Instead of any real content, the pages push visitors into an ad/affiliate funnel that collects emails, payment cards for fake “age verification,” or tricks people…
A phishing operation dubbed “Milk Dragon” uses fake discount posts on Facebook and TikTok to lure shoppers to lookalike online stores. Victims are tricked into entering payment card details and then a one-time password on a spoofed 3D Secure verification page, enabling fraudulent purchases or…
This article describes real election-themed scams that use fake voter-support messages, political donation appeals, survey prizes, official-looking penalty notices, and bogus campaign merchandise. The scams pressure voters to click fraudulent links, share personal or payment information, download…
A wave of fake websites impersonates Calendly booking pages for “Meta Careers” job interviews. After victims select an interview time and complete a fake CAPTCHA, the site prompts them to log in to Facebook and then Google, capturing passwords and even two-factor authentication codes in real time.…
Researchers uncovered a human-run phishing platform that pretends to be ad-management products for popular AI brands (ChatGPT, Gemini, Claude, and others). Victims are pushed to click a “Connect” flow that opens a convincing fake login window (showing trusted domains like accounts.google.com) to…
Researchers found dozens of lookalike websites impersonating real crypto projects and promising a small, believable reward boost if users “vote” on a rewards distribution date. The vote is fake; clicking “Vote now” triggers a wallet connection prompt and can lead to malicious approval/signature…
