On August 5th, the security research organization CTM360's latest report revealed that a hacking campaign codenamed "ClickTok" is launching attacks against TikTok Shop users globally. The attackers have established over 10,000 counterfeit websites and 5,000 malicious applications, stealing user account credentials and spreading SparkKitty spyware through hybrid fraud methods, with the intention of stealing users' cryptocurrency wallets.
The campaign has expanded beyond the 17 countries officially covered by TikTok Shop. Attackers primarily use low-cost domains (such as .top and .shop) to create phishing websites and spread malicious programs through malicious QR codes and download links.
Security experts recommend that users access TikTok Shop through official applications, carefully verify website authenticity, and avoid downloading software from unknown sources.
