A large-scale cybercrime campaign called ClickTok is targeting TikTok Shop users with thousands of fake websites and Trojanized mobile apps. The scammers use AI-generated content to lure victims into phishing traps or to download malware that steals money and sensitive data.
How the Scam Works
The campaign begins with realistic TikTok-style videos and ads that promote exclusive deals. These lead users to fake domains posing as TikTok Shop, often using suspicious domain extensions like .top, .shop, or .icu.
Victims either land on phishing pages or are prompted to download a fake shopping app that looks like the real TikTok Shop. This app, laced with spyware called SparkKitty, collects personal data directly from the device.
What the Malware Does
Once installed, the malware can:
- Steal login credentials and cookies
- Collect personal data including names, phone numbers, and payment info
- Scrape crypto wallet seed phrases from device storage
- Fingerprint the device for future attacks
- Allow remote access for continued exploitation
Monetization Methods
The scam doesn’t stop at stealing data. Scammers trick victims into paying for fake products or commissions. They lock others into affiliate scam dashboards that display fake earnings and require “top-ups” to withdraw, funneling more money into the attackers’ hands.
Who’s Affected
The scam has spread well beyond the official TikTok Shop markets. Its global reach is fueled by constantly updated visuals, convincing scripts, and a massive network of fake domains—over 15,000 linked to the campaign.
How to Stay Safe
- Only use the official TikTok app and website
- Avoid clicking on links in promotional DMs or suspicious ads
- Never download apps from unofficial sources
- Use mobile security software to detect malware
- Double-check domain names before entering login or payment details
Conclusion
The TikTok fake shop scam shows how sophisticated cybercriminals have become. By combining social engineering, malware, and fake e-commerce fronts, they’re draining crypto wallets and stealing data from unsuspecting users. Staying alert, using official channels, and avoiding too-good-to-be-true deals can help you avoid becoming the next victim.
0 responses to “TikTok Scam Uses Fake Shops and Malware to Steal Money and Data”