AI-generated TikTok scams steal crypto from over 10K victims

Cybersecurity researchers have uncovered a sophisticated scam campaign where threat actors use AI-generated videos to impersonate TikTok Shop sellers, tricking users into depositing cryptocurrency and downloading malware. CTM360, a cybersecurity firm, identified over 10,000 phishing URLs and 5,000 malicious app download sites in what they describe as a “widespread, ongoing, malicious campaign” that exploits user trust in TikTok’s brand recognition.

What you should know: Scammers are creating fake TikTok Shop profiles complete with AI-generated content to appear legitimate while distributing malware called SparkKitty.

• The campaign uses replicas of TikTok Shop profiles with AI-generated videos to convince users they’re interacting with real sellers.
• Fake ads on Facebook and TikTok promise steep discounts but redirect users to bogus versions of TikTok Wholesale and TikTok Mall.
• CTM360 discovered “10,000+ phony phishing URLs that are used to lure users into depositing cryptocurrency on fraudulent storefronts, leveraging fake product listings and urgency tactics.”

How the scam works: Threat actors masquerade as TikTok Shop affiliate management platforms to trick users into downloading malicious apps.

• Scammers distribute malicious app files through embedded download links and QR codes across thousands of fake download sites.
• Once downloaded, the apps deploy SparkKitty malware capable of harvesting data from both Android and iOS devices.
• Victims are asked to pay in cryptocurrency or deposit money into fake on-site wallets with promises of “future commission payouts or withdrawal bonuses that never materialize.”

Red flags to watch for: The scam sites use telltale signs that can help users identify fraudulent operations.

• Fake sites typically use free or low-cost top-level domains such as .top, .shop, and .icu rather than official TikTok domains.
• Legitimate TikTok Shop and affiliate programs operate exclusively through tiktok.com and have strict guidelines.
• Real TikTok representatives won’t proactively reach out asking users to deposit money into crypto wallets.

Why this matters: The campaign represents a broader trend of scammers exploiting trusted brand names and AI technology to commit fraud.

• “The core motive is fraudulent financial gain, exploiting the trust in online shopping, affiliate earnings, and the irreversibility of certain payment methods,” CTM360 explains.
• The scam follows similar patterns to other recent social media fraud, including fake Starlink deals that circulated on Facebook last month to steal credit card information.