Scammers are setting up lookalike websites that copy TikTok Shop’s design, trust badges, and wording to trick people into thinking they’re shopping inside TikTok. The main risk is entering payment (and sometimes loan-application) details into a site that has no real connection to TikTok, leading to fraud, identity theft, or stolen card data.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
If a shopping site looks like TikTok Shop, but you didn’t open it from inside the TikTok app, hit pause. Scam sites are copying TikTok Shop’s look, its category layout, and even fake trust badges like “trusted sellers” and “secure service” to make you think you’re still inside TikTok, right up until checkout. The real danger is the checkout. One version just wants your card details for non-delivery and resale. Another pushes a “Wholesale TikTok Shop” with a built‑in loan service, asking for ID documents and banking info, perfect for identity theft. Your move: only use TikTok Shop from inside the official TikTok app. If you got there from an ad, DM, or search result in a browser, back out, don’t enter payment or loan details.
Scammers are using fake webpages that appear in search results for “TikTok” plus adult terms, promising “exclusive” explicit videos. Instead of any real content, the pages push visitors into an ad/affiliate funnel that collects emails, payment cards for fake “age verification,” or tricks people…
Cofense reports a sustained rise in real phishing campaigns disguised as party/event invitations that trick people into clicking links. The same invitation lure is being used both to steal usernames/passwords via fake login pages and to install legitimate-but-abused remote access tools that give…
Researchers found a turnkey scam kit sold on a cybercrime forum that lets criminals quickly stand up a fake crypto “presale” website styled to look like Tesla. The site uses pressure tactics and a fake investment dashboard to trick people into either handing over their wallet recovery phrase or…
Microsoft says a Russian-linked group is abusing hotel and conference Wi‑Fi “captive portals” to trick travelers into entering corporate credentials or installing malware. Victims see what looks like a normal Wi‑Fi login flow, but attackers manipulate DNS/website traffic to redirect them to fake…
Scammers are setting up fake Fortnite “rewards,” “locker value,” and “competition” websites that funnel players to a fake Epic Games login page. The sites trick people into signing in so attackers can steal Epic usernames and passwords, then take over accounts for resale, fraud, or further scams. A…
Criminal groups are stealing Meta Business Manager and Google Ads accounts using phishing that arrives through trusted platforms like Salesforce, Google Workspace mail-merge, and SharePoint links. The stolen accounts are valuable not just for the budget inside them, but because older accounts with…
