Stolen TikTok Videos, Bent on Fraud, Invade YouTube Shorts

Scammers are taking full advantage of the launch of Google’s new TikTok competitor, YouTube Shorts, which has turned out to be an awesome tool for feeding billions of engaged viewers stolen content. That content is being used to run rackets like promoting adult dating websites, hustling diet pill...

TikTok: URL Scheme misconfiguration on TikTok for IOS

A misconfigured URL schema on a TikTok iOS endpoint could have resulted in a user being forced to follow other accounts by visiting a malicious website or HTML page. We thank @glassplant for reporting this to our team...

TikTok: Cross site scripting via file upload in subdomain ads.tiktok.com

A file upload XSS cross-site scripting vulnerability was found in TikTok ads ticketing platform. Due to missing checks it was possible to upload .svg files which contained XSS payload. We thank @blubluuu for reporting this to our team and confirming its resolution...

TikTok: Clickjacking Vulnerability In Whole Page Ads Tiktok

A clickjacking vulnerability was found on a TikTok Ads endpoint, where an attacker, once obtaining the ID, could trick another user to perform actions such as creating or deleting campaigns. We thank @rioncool22 for reporting this to our team...

TikTok: Clickjacking Vulnerability Can Leads To Delete Developer APP

A clickjacking vulnerability was found on a TikTok subdomain, where an attacker could trick another user into deleting the Developer App. We thank @rioncool22 for reporting this to our team...

A week in security (Nov 15 – Nov 21)

Last week on Malwarebytes Labs Instagram’s memorialize feature abused to memorialize…Instagram’s boss Evasive manoeuvres: HTML smuggling explained FBI server hijacked to send up to 100,000 bogus attack mails New Mac malware raises more questions about Apple’s security patching SharkBot Android...

Phishers target TikTok influencers with verification promises and copyright threats

Influencers on TikTok are feeling the pinch of scams and phishing thanks to targeted campaigns hungry for fresh logins. The phishing campaigns make use of much older tactics seen across multiple platforms down the years. It’s a one-two combo of “Do this quickly, or else something bad will happen”...

TikTok: Multiple vulnerability leading to account takeover in TikTok SMB subdomain.

Multiple vulnerabilities like Insecure Direct Object Reference IDOR, Cross-Site Request Forgery CSRF, XSS were found that could have resulted in account takeover on the TikTok SMB subdomain. First, an Insecure Direct Object Reference IDOR was found, where a missing authorization check could allow...

Phishing Scam Aims to Hijack TikTok ‘Influencer’ Accounts

A recently discovered phishing scam tried to takeover more than 125 high-profile user accounts on TikTok. Researchers said the campaign marks one of the first major attacks on “influencers” found on the TikTok social-media platform. Researchers at cloud email security provider Abnormal Security...

The Sneaky Way TikTok Is Connecting You to Real-Life Friends

The social network got huge by ignoring who you know. That's increasingly no longer the case...

TikTok: reflected xss on the path m.tiktok.com

A cross site scripting vulnerability was found in Ambassador Manage endpoint. We thank @semsem123 for reporting this to our team...

TikTok: IDOR the ability to view support tickets of any user on seller platform

Due to an Insecure Direct Object Reference IDOR vulnerability, an attacker could have potentially viewed support tickets on seller platform. We thank @lewaperbb for reporting this to our team...

TikTok: Open Redirect TO Stealing aadvid

An open redirect was found on TikTok Ads due to an improper validation of the "redirect" parameter. We thank @lu3ky-13 for reporting this to our team...

TikTok: Reflected XSS on TikTok Website

A cross-site scripting XSS vulnerability was found on TikTok.com via multiple parameters. We thank @homosec for reporting this to our team and confirming its resolution...

Data analytics firm exposed 2m Instagram and TikTok users’ data

By Deeba Ahmed The victims of this "data leak" also include celebrities like Alicia Keys, Loren Gray, Kylie Jenner, Ariana Grande, and Kim Kardashian. This is a post from HackRead.com Read the original post: Data analytics firm exposed 2m Instagram and TikTok users data...

TikTok: HTML Injection via TikTok Ads Email Share

A HTML injection was found on a TikTok Ads endpoint via the "SenderName" parameter. We thank @lu3ky-13 for reporting this to our team...

TikTok: Cross-site Scripting (XSS) - Stored on ads.tiktok.com in Text field

A XSS cross-site scripting vulnerability was found in TikTok ads through "text" field. We thank @lu3ky-13 for reporting this to our team...

TikTok Serves Up Fresh Gamer Targets

TikTok has made people do all sorts of wild things — eat frozen honey, work on their choreography and even fall for malicious malvertising campaigns. The latest TikTok attacks are getting served to gamers on the platform disguised as “free” or “hacked” versions of games like Among Us, free Steam...

A week in security (Oct 11 – Oct 17)

Last week on Malwarebytes Labs Google warns some users that FancyBear’s been prowling around Inside Apple: How macOS attacks are evolving The joy of phishing your employees ExpressVPN made a choice, and so did I: Lock and Code S02E19 Update now! Apple patches another privilege escalation bug in i...

“Free Steam game” scams on TikTok are Among Us

TikTok has long since evolved beyond being thought of as "just" dance clips, also becoming a home for educational and informative content presented in a fun and casual way. There are accounts themed around pretty much any interest you can think of, and one of the biggest is gaming. Its not all...