Beware of 'FraudonTok': fake TikTok clones steal crypto users' seed phrases via AI deepfakes & SparkKitty malware.

Beware of 'FraudonTok': fake TikTok clones steal crypto users' seed phrases via AI deepfakes & SparkKitty malware.

In a worrying trend, cybersecurity researchers have uncovered a sophisticated scam campaign targeting TikTok users, dubbed "FraudonTok." This elaborate scheme leverages AI-generated content and fake domains to steal cryptocurrency and compromise user accounts. The campaign, which has been dubbed "FraudonTok," involves over 15,000 fake TikTok Shop websites hosted on various top-level domains (TLDs) [1].

The scam begins with enticing ads on social media platforms like TikTok and Facebook, promising discounted products and influencer endorsements. Users are lured to fake TikTok Shop websites, where they are tricked into downloading malicious apps, entering fake login credentials, or depositing cryptocurrency into fraudulent storefronts [1].

One of the key components of the FraudonTok campaign is the use of AI-generated deepfakes, which mimic influencers and brand ambassadors. These deepfakes, along with fake ads, are designed to create a sense of legitimacy and trust, making users more likely to fall for the scam [1].

The campaign also utilizes a cross-platform malware called SparkKitty, which can infect both Android and iOS devices. This malware is often disguised as a TikTok Shop affiliate management platform, encouraging users to download an app that can hijack accounts and steal sensitive information, including cryptocurrency seed phrases [1].

To protect against this threat, users are advised to exercise caution when encountering deals that seem too good to be true. It is crucial to double-check URLs for any anomalies and to be wary of unsolicited requests for cryptocurrency deposits. The official TikTok Shop and affiliate programs are hosted on tiktok.com and adhere to strict guidelines [1].

This campaign is part of a broader trend of sophisticated phishing operations targeting popular platforms. Similar scams have been observed targeting Meta Business Suite users in a campaign called Meta Mirage [1].

In response to these threats, the U.S. Department of the Treasury's Financial Crimes Enforcement Network (FinCEN) has issued an advisory urging financial institutions to be vigilant in identifying and reporting suspicious activity involving convertible virtual currency (CVC) kiosks [1].

References:
[1] https://medium.com/@Cyber-AppSec/15-000-fake-tiktok-shop-domains-are-stealing-crypto-3835c17563b0
[2] https://theoutpost.ai/news-story/ai-powered-scam-campaign-targets-tik-tok-shop-users-with-fake-domains-and-malware-18673/