Cybersecurity researchers have uncovered a large-scale malicious campaign targeting TikTok Shop users worldwide, aiming to steal credentials and spread trojanized apps.

Bahrain-based cybersecurity firm has dubbed the scam campaign “ClickTok,” highlighting the use of Meta ads and AI-generated TikTok-style videos to mimic influencers. At its core, the attack relies on over 15,000 fake domains resembling TikTok URLs, mostly using top-level domains like .top, .shop, and .icu.

These fake domains host phishing pages that steal credentials or deliver fake apps containing SparkKitty malware, which can harvest data from both Android and iOS devices.

“The scam mimics legitimate TikTok Shop activity through fake ads, profiles, and AI-generated content, tricking users into engaging to distribute malware,”

the company noted.

“Fake ads are widely circulated on Facebook and TikTok, featuring AI-generated videos that mimic real promotions to attract users with heavily discounted offers.”

Once installed, the malicious app prompts users to log in via email but deliberately fails to push them toward a Google login. This likely aims to exploit OAuth session tokens for unauthorized access. If users try to access TikTok Shop, they’re redirected to a fake login page to steal their credentials.

The app also contains SparkKitty malware, which can fingerprint devices, use OCR to scan screenshots for crypto wallet seed phrases, and send them to an attacker-controlled server.

The disclosure coincides with a second phishing campaign, dubbed CyberHeist Phish, which uses Google Ads and thousands of fake links to lure users searching for corporate banking sites to spoofed login pages designed to steal credentials.

“Criminals are relentless in their efforts to steal money from victims, and they’ve learned to exploit innovative technologies like CVC kiosks,”

said FinCEN Director Andrea Gacki.

“The United States is committed to safeguarding the digital asset ecosystem for legitimate businesses and consumers, and financial institutions are a critical partner in that effort.”