15,000 Fake TikTok Shop Domains Deliver Malware, Steal Crypto via AI-Driven Scam Campaign

Cybersecurity researchers have lifted the veil on a widespread malicious campaign that's targeting TikTok Shop users globally with an aim to steal credentials and distribute trojanized apps. "Threat actors are exploiting the official in-app e-commerce platform through a dual attack strategy that...

TikTok: CSRF in ticket function

A cross-site request forgery CSRF vulnerability was found on a TikTok Shop endpoint, which could have resulted in the arbitrary creation of tickets. The vulnerability was reported by @ibrahim0936356 to the TikTok team...

TikTok: Add products to any livestream.

An improper access control issue on a TikTok Shop endpoint could have resulted in arbitrary products being added to livestreams. We thank @datph4m for reporting this to our team...