Scammers are setting up lookalike websites that copy TikTok Shop’s design, trust badges, and wording to trick people into thinking they’re shopping inside TikTok. The main risk is entering payment (and sometimes loan-application) details into a site that has no real connection to TikTok, leading to fraud, identity theft, or stolen card data.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
If a shopping site looks like TikTok Shop, but you didn’t open it from inside the TikTok app, hit pause. Scam sites are copying TikTok Shop’s look, its category layout, and even fake trust badges like “trusted sellers” and “secure service” to make you think you’re still inside TikTok, right up until checkout. The real danger is the checkout. One version just wants your card details for non-delivery and resale. Another pushes a “Wholesale TikTok Shop” with a built‑in loan service, asking for ID documents and banking info, perfect for identity theft. Your move: only use TikTok Shop from inside the official TikTok app. If you got there from an ad, DM, or search result in a browser, back out, don’t enter payment or loan details.
Scammers are using fake webpages that appear in search results for “TikTok” plus adult terms, promising “exclusive” explicit videos. Instead of any real content, the pages push visitors into an ad/affiliate funnel that collects emails, payment cards for fake “age verification,” or tricks people…
This bulletin describes multiple real-world scams where attackers make fake pages and messages look like routine, trusted experiences (search answers, Google login pop-ups, “giveaways,” and official-sounding calls). Examples include a fake Claude Max giveaway using a convincing fake Google sign-in…
Researchers found a real phishing campaign offering a “free” Claude Max upgrade to trick people into signing in with Google. The site uses a fake, draggable Google login pop-up (“browser-in-the-browser”) that looks legitimate and captures credentials. A stolen Google account can expose email and…
Researchers found a phishing campaign offering a “free” upgrade to Claude Max to trick people into signing in with Google. The page uses a convincing fake, draggable Google login window (“browser-in-the-browser”) to capture credentials, potentially giving criminals access to email, documents, and…
Following a Revolut data breach, scammers sent text messages that appeared to come from the same message thread as legitimate Revolut texts. The texts pushed victims to click a link for a fake identity “liveness check,” request camera access, and then capture passwords, information that could be…
A real phishing campaign impersonated postal couriers (including Belgium’s bpost) to trick people into paying a small “customs fee” for an undelivered parcel. Victims were sent to a fake courier website that collected personal details, then escalated to stealing full card and banking (IBAN)…
