TLDR: TikTok Shop is battling a large-scale, AI-driven scam campaign, codenamed ‘FraudOnTok,’ which uses over 15,000 fake domains, AI-generated videos, and malware to steal user credentials and cryptocurrency. The sophisticated operation combines phishing and malware distribution, mimicking legitimate TikTok Shop activities and influencer promotions to deceive users globally. Cybersecurity firm CTM360 uncovered the campaign, highlighting its multi-pronged approach to financial fraud.
TikTok Shop is currently facing a significant challenge from a sophisticated and widespread malicious campaign, dubbed ‘FraudOnTok’ by cybersecurity researchers. This operation, which leverages artificial intelligence (AI) to enhance its deceptive tactics, aims to steal user credentials and distribute trojanized applications globally. Cybersecurity firm CTM360, based in Bahrain, has unveiled the details of this multi-pronged attack.
The core strategy of ‘FraudOnTok’ involves creating deceptive replicas of the TikTok Shop platform. Threat actors are exploiting the in-app e-commerce platform through a dual attack, combining phishing and malware. These fake platforms trick users into believing they are interacting with legitimate affiliates or the actual TikTok Shop, as reported by CTM360.
A central element of this campaign is the proliferation of over 15,000 lookalike domains that closely resemble official TikTok URLs. The majority of these fraudulent domains are hosted on top-level domains such as .top, .shop, and .icu. These domains serve as hosts for phishing landing pages designed to either harvest user credentials or distribute malicious applications.
The scam employs AI-generated TikTok videos that mimic real influencers or official brand ambassadors, circulating fake ads widely on platforms like Facebook and TikTok. These AI-powered promotions lure users with heavily discounted offers, tricking them into engaging with the fraudulent content and ultimately distributing malware.
The fraudulent scheme has three primary objectives, all geared towards financial gain:
1. Deceiving Buyers and Affiliate Sellers: Users are enticed with bogus and heavily discounted products, then pressured to make payments in cryptocurrency.
2. Fake On-Site Wallets: Affiliate participants are convinced to ‘top up’ fake on-site wallets with cryptocurrency, under the false promise of future commission payouts or withdrawal bonuses that never materialize.
3. Credential Theft via Trojanized Apps: Fake TikTok Shop login pages are used to steal user credentials, or victims are instructed to download trojanized TikTok apps.
Once installed, the malicious app attempts to trick victims into entering their email-based credentials, deliberately failing multiple times to prompt an alternative login using their Google account. This tactic aims to bypass traditional authentication and weaponize OAuth-based session tokens for unauthorized access. The app also contains ‘SparkKitty’ malware, capable of device fingerprinting and using optical character recognition (OCR) to scan user photo galleries for cryptocurrency wallet seed phrases, which are then exfiltrated to attacker-controlled servers.
This campaign highlights a growing trend of sophisticated digital fraud, with FinCEN Director Andrea Gacki emphasizing the relentless efforts of criminals to exploit innovative technologies like convertible virtual currency (CVC) kiosks. The U.S. Department of the Treasury’s Financial Crimes Enforcement Network (FinCEN) has urged financial institutions to be vigilant in identifying and reporting suspicious activities to combat such illicit operations.
Also Read:
- AI Fuels Escalation of North Korea and China-Backed Cyberattacks on Korean Businesses
- Google Cloud’s 2026 Cybersecurity Forecast: A Looming Surge in AI-Powered Cyberattacks and Global Extortion
While the original news title indicated a publication date of November 6, 2025, the detailed information found through internet search is from August 5, 2025. It is possible the Business Insider article from November 2025 is a follow-up report on this ongoing issue.
