Full Report
Threat actors are targeting TikTok for Business accounts in a phishing campaign that prevents security bots from analyzing malicious pages. [...]
Analysis Summary
# Incident Report: Phishing Campaign Targeting TikTok for Business Accounts
## Executive Summary
A targeted phishing campaign has been identified targeting TikTok for Business and Google Careers accounts to hijack high-value advertising credentials. The attack utilizes Cloudflare Turnstile to bypass security bots and employs reverse proxy techniques to bypass Multi-Factor Authentication (MFA). The primary goal is likely the takeover of accounts for malvertising, ad fraud, and the distribution of malicious content.
## Incident Details
- **Discovery Date:** March 26, 2026
- **Incident Date:** Ongoing (Domains registered starting March 24, 2026)
- **Affected Organization:** Various TikTok for Business users and Google Careers applicants
- **Sector:** Advertising, Marketing, Recruitment
- **Geography:** Global
## Timeline of Events
### Initial Access
- **Date/Time:** March 24, 2026 (Registrations began)
- **Vector:** Likely email or direct message impersonating "Schedule a Call" invites for Google Careers or TikTok Business services.
- **Details:** Attackers use legitimate Google Storage URLs to redirect victims to malicious landing pages.
### Lateral Movement
- **Mechanism:** Not traditional network lateral movement; however, the use of Google Single Sign-On (SSO) allows attackers to potentially compromise both TikTok and Google accounts simultaneously if the user authenticates via SSO.
### Data Exfiltration/Impact
- **Data Stolen:** Corporate credentials, session cookies (via reverse proxy), and 2FA tokens.
- **Impact:** Complete account takeover of TikTok for Business accounts, enabling unauthorized ad spend and malicious content distribution.
### Detection & Response
- **Detection:** Discovered by Push Security through analysis of suspicious domain registrations and phishing infrastructure patterns.
- **Response:** Public disclosure and reporting of domains to registrars (NiceNIC) and hosting providers.
## Attack Methodology
- **Initial Access:** Impersonation of "Schedule a Call" recruitment or business support interfaces.
- **Persistence:** High-jacking of session cookies via an Adversary-in-the-Middle (AiTM) reverse proxy.
- **Defense Evasion:** Use of Cloudflare Turnstile to block security bots/crawlers from analyzing the page; hosting on legitimate Google Storage buckets.
- **Credential Access:** Phishing forms and reverse proxy pages that intercept credentials and MFA codes in real-time.
- **Discovery:** Preliminary forms are used to validate if a victim's email is a genuine business address.
- **Impact:** Misuse of advertising budgets (Ad Fraud) and reputational damage.
## Impact Assessment
- **Financial:** Potential for significant unauthorized advertising spend on compromised business accounts.
- **Data Breach:** Exposure of business contact information and corporate credentials.
- **Operational:** Loss of access to TikTok and Google marketing platforms.
- **Reputational:** High; hijacked accounts can be used to spread scams or malware, appearing to come from a legitimate business.
## Indicators of Compromise
### Network Indicators
- welcome.careerscrews[.]com
- welcome.careerstaffer[.]com
- welcome.careersworkflow[.]com
- welcome.careerstransform[.]com
- welcome.careersupskill[.]com
- welcome.careerssuccess[.]com
- welcome.careersstaffgrid[.]com
- welcome.careersprogress[.]com
- welcome.careersgrower[.]com
- welcome.careersengage[.]com
### Behavioral Indicators
- Redirection through legitimate Google Storage APIs to unexpected domains.
- Requirement to pass a Cloudflare Turnstile (captcha) before viewing a login or "scheduling" page.
## Response Actions
- **Containment:** Reporting of the Google Storage bucket and domains to NiceNIC.
- **Eradication:** Recommendation for affected users to reset passwords and invalidate all active sessions.
## Lessons Learned
- **Bot-Detection Misuse:** Attackers are increasingly using legitimate security tools (like Turnstile) to protect their own malicious infrastructure from security analysts.
- **MFA Vulnerability:** Standard TOTP (Time-based One-Time Password) and SMS-based 2FA are vulnerable to reverse-proxy phishing attacks.
- **SSO Risks:** While convenient, Google SSO creates a single point of failure where a successful TikTok phishing attempt can lead to a full Google account compromise.
## Recommendations
- **Adopt Passkeys:** Implement FIDO2/WebAuthn (Passkeys) or hardware security keys (e.g., YubiKey) which are resistant to reverse-proxy phishing.
- **Domain Monitoring:** Organizations should monitor for newly registered domains containing keywords like "careers," "welcome," and "staff."
- **Employee Training:** Educate staff on the risks of "Schedule a Call" lures and the importance of verifying URLs, even when they appear to originate from Google Storage.