{"id":411,"date":"2026-03-27T13:15:53","date_gmt":"2026-03-27T13:15:53","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=411"},"modified":"2026-03-27T13:15:53","modified_gmt":"2026-03-27T13:15:53","slug":"aitm-phishing-targets-tiktok-business-accounts-using-cloudflare-turnstile-evasion","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=411","title":{"rendered":"AitM Phishing Targets TikTok Business Accounts Using Cloudflare Turnstile Evasion"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Mar 27, 2026<\/span><\/span>Ransomware \/ Malware<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

Threat actors are using adversary-in-the-middle (AitM) phishing pages to seize control of TikTok for Business accounts in a new campaign, according to a report from Push Security.<\/p>\n

Business accounts associated with social media platforms are a lucrative target, as they can be weaponized by bad actors for malvertising and distributing malware.<\/p>\n

\u00abTikTok has been historically abused to distribute malicious links and social engineering instructions,\u00bb Push Security said<\/a>. \u00abThis includes multiple infostealers like Vidar, StealC, and Aura Stealer delivered via ClickFix-style instructions with AI-generated videos posed as activation guides for Windows, Spotify, and CapCut.\u00bb<\/p>\n

The campaign begins with tricking victims into clicking on a malicious link that directs them to either a lookalike page impersonating TikTok for Business or a page that’s designed to impersonate Google Careers, along with an option to schedule a call to discuss the opportunity.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

It’s worth noting that a prior iteration of this credential phishing campaign was flagged<\/a> by Sublime Security in October 2025, with emails masquerading as outreach messages used as a social engineering tactic.<\/p>\n

<\/p>\n

Regardless of the type of page served, the end goal is the same: perform a Cloudflare Turnstile check to block bots and automated scanners from analyzing the contents of the page and serve a malicious AitM phishing page login page that’s designed to steal their credentials.<\/p>\n

\"\"<\/a><\/div>\n

The phishing pages are hosted on the following domains –<\/p>\n