TikTok for Business accounts targeted with AITM phishing that bypasses MFA

A new phishing campaign is hijacking TikTok for Business accounts using adversary-in-the-middle (AITM) reverse proxy pages - meaning it captures credentials, session cookies, and MFA codes in real time. Victims land on cloned TikTok or Google Careers pages after clicking links that redirect through legitimate Google Storage URLs. The real kicker: most users log in via Google SSO, so one compromise gives attackers both TikTok and Google accounts.

Check

Alert marketing and social media teams who manage TikTok Business accounts.

Affected

Any TikTok for Business account, especially those using Google SSO for login.

Fix

Use hardware security keys (FIDO2) instead of SMS/app-based MFA - AITM kits can't intercept them. Review TikTok account sessions for unauthorized access. Train staff to verify URLs before entering credentials.