TikTok might be the hottest social media platform in the world. Still, it’s spreading more than dance videos and questionable recipes. Hackers have found a way to use the site for their phishing campaigns, hiding malicious links in user bios to steal Microsoft 365 login credentials. The TikTok links exploit user trust in the platform but are fairly easy to spot and avoid.
Hackers Are Using Social Media To Steal Your Information
This recently discovered social media exploit starts like so many others: your email inbox. Victims receive an email that looks like it came from their company’s IT department asking them to confirm their request to delete their email box.
Suppose the email recipient clicks on the link. In that case, it redirects to TikTok, which is a pretty big clue that the initial message isn’t legitimate. The hackers then exploit a TikTok links exploit, redirecting links in the user bio to a fake Office 365 login page. The link may redirect several times before reaching this page. Still, the final destination is always the same poorly constructed login page.
The purpose of this campaign is to hijack Microsoft credentials. By stealing Office 365 usernames and passwords, hackers gain unauthorized access to other secure areas of your network.
Avoiding TikTok Link Hijacks
As phishing campaigns go, this one is particularly amateur. Most everyone with a basic knowledge of the signs of fake emails will immediately delete it without a second thought. Despite claiming to come from IT, the email domain in the messages doesn’t match any company, and the message contains numerous spelling and grammatical mistakes.
For those who don’t spot the issues in the initial email and click the link, the fact that it redirects to TikTok should, again, be a red flag. The final redirect, the Microsoft login page, also contains many errors that should stop anyone from “logging in.”
One trick hackers use to make the login page more legitimate is auto-filling the recipient’s email in the correct field. However, when you add a password, that information will go directly to the hackers for their nefarious purposes.
Be suspicious of links and attachments, especially when they request urgent action or ask you to confirm something you never requested.
Other clues that an email is dangerous and includes malicious links or downloads are an unusual sender address and poor spelling and grammar. Some hackers launching TikTok links exploits attempt to replace characters with similar ones (using 0 for O or vice versa, for example), so read suspicious messages carefully. Finally, be wary of any message that asks for personal information, as legitimate companies will never do that.
