A massive, AI-driven scam campaign codenamed 'ClickTok' is targeting TikTok Shop users worldwide. Cybersecurity firm CTM360 reports that threat actors have created over 15,000 fake TikTok Shop domains to execute a dual-pronged attack involving phishing and malware distribution. The campaign leverages AI-generated videos and fake influencer promotions on Meta platforms to lure victims to these lookalike sites. Once there, users are tricked into entering credentials on phishing pages or downloading a trojanized TikTok app. This malicious app contains the SparkKitty malware, a cross-platform threat designed to steal sensitive data, including cryptocurrency wallet seed phrases from screenshots on both Android and iOS devices. The scam's primary goals are financial, using fake product listings, fraudulent crypto payments, and credential theft to exploit both buyers and affiliate sellers on the popular e-commerce platform.
A state-sponsored threat actor, CL-STA-0969, has been targeting telecommunications organizations in Southeast Asia in a sophisticated espionage campaign lasting 10 months. According to Palo Alto Networks Unit 42, the attackers focused on critical telecom infrastructure between February and November 2024. The campaign is notable for its high operational security (OPSEC) and the deployment of specialized tools like Cordscan to collect mobile device location data. While the group gained remote control over compromised networks, researchers found no evidence of data exfiltration. The actor shares significant overlaps with the China-nexus group Liminal Panda, indicating a calculated and persistent effort to maintain stealthy access to sensitive networks.
Newer posts
