Crypto Scammers Exploit TikTok Shop Users with Phishing and Malware Campaign

Crypto scammers are exploiting TikTok Shop users through a sophisticated phishing and malware campaign, according to a report by cybersecurity firm CTM360 [1]. The initiative, dubbed “ClickTok,” leverages over 10,000 fake domains and trojanized apps to mimic the TikTok Shop platform, with the intent of stealing user credentials and cryptocurrency wallet information [2]. These domains, which closely resemble legitimate URLs, are often accessed via AI-generated TikTok videos and fake Meta ads that mimic influencers, luring users toward fraudulent storefronts [3].

Victims are directed to counterfeit sites offering heavily discounted products, often with urgency tactics such as countdown timers to prompt impulsive decisions. Once a user engages with these sites, they are typically asked to make payments in cryptocurrency—primarily Tether (USDT)—which is difficult to reverse [4]. The scammers also deploy advance fee scams targeting users of the TikTok Shop Affiliate Program, offering fake earnings and commissions that never materialize [5].

Social engineering tactics are a key component of the attack. Fraudsters use WhatsApp and Telegram to pose as TikTok affiliates and entice users into depositing funds into bogus crypto wallets [6]. The malware variant embedded in the malicious apps, known as SparkKitty, silently collects sensitive data such as screenshots, clipboard content, and images, which may include wallet credentials [7]. The scale of the campaign is significant, with over 15,000 spoofed domains and 5,000 unique malicious app variants identified to date [8].

The attack underscores the growing trend of cybercriminals diversifying beyond platforms like Facebook and X, capitalizing on the popularity of TikTok Shop, which operates in 17 countries [9]. The campaign’s use of AI to generate convincing fake seller profiles and product videos further complicates user efforts to distinguish between genuine and fraudulent listings [10]. Given that TikTok’s user base is younger than those of other platforms, with 18 to 34-year-olds being particularly active, the vulnerability to such scams is heightened [11].

Cybersecurity experts have issued warnings and mitigation strategies, urging users to verify the authenticity of websites before entering login or payment details and to avoid downloading unauthorized apps [12]. Businesses and affiliate marketers are advised to monitor for brand impersonation and implement internal training to identify phishing attempts and fake apps [13]. The National Security Operations Centre (NSOC) has also released guidance to help users and organizations protect themselves from the threat [14].

Source:

[1] The – [https://thehackernews.com/2025/08/15000-fake-tiktok-shop-domains-deliver.html](https://thehackernews.com/2025/08/15000-fake-tiktok-shop-domains-deliver.html)

[2] cirt.gov.jm – [https://www.cirt.gov.jm/alert/ctm360-spots-malicious-clicktok-campaign-targeting-tiktok-shop-tiktok-wholesale-and-tiktok](https://www.cirt.gov.jm/alert/ctm360-spots-malicious-clicktok-campaign-targeting-tiktok-shop-tiktok-wholesale-and-tiktok)

[3] SC – [https://www.scworld.com/brief/malware-deployed-in-massive-tiktok-shop-scam](https://www.scworld.com/brief/malware-deployed-in-massive-tiktok-shop-scam)

[4] Astrill – [https://www.astrill.com/blog/fake-tiktok-shop-sites-spread-malware-steal-crypto/](https://www.astrill.com/blog/fake-tiktok-shop-sites-spread-malware-steal-crypto/)

[5] Forbes – [https://www.forbes.com/sites/daveywinder/2025/08/05/tiktok-shop-password-warning-issued-as-clicktok-hackers-strike/](https://www.forbes.com/sites/daveywinder/2025/08/05/tiktok-shop-password-warning-issued-as-clicktok-hackers-strike/)

[9] Decrypt – [https://decrypt.co/333983/crypto-scammers-tiktok-shop-users](https://decrypt.co/333983/crypto-scammers-tiktok-shop-users)