The growing popularity of TikTok Shop has made it one of the main targets for cybercriminals. Today, we want to inform you about ClickTok, a global malware campaign putting thousands of users at risk — especially those shopping or participating in affiliate programs on the platform.
Recently, cybersecurity firm CTM360 uncovered this malicious operation, which combines phishing and spyware to steal credentials and empty cryptocurrency wallets. At TecnetOne, we believe it’s crucial that you understand how this threat works, the tactics it uses, and what steps you can take to protect yourself.
ClickTok is no ordinary cyberattack. It is a highly coordinated campaign that uses a hybrid model of phishing and malware to deceive TikTok Shop buyers and sellers.
What makes this scam particularly dangerous is its ability to perfectly mimic TikTok’s legitimate ecosystem. Cybercriminals have created thousands of fake websites that replicate the interface of TikTok Shop, TikTok Wholesale, and even TikTok Mall.
Their goals are clear:
In short: they aim to take over your accounts and drain your digital assets.
The attack unfolds in several carefully crafted stages:
Attackers spread social media and Meta Ads using AI-generated videos that invite users to visit fake TikTok stores.
The links lead to spoofed domains (e.g., .top, .shop, .icu) designed to appear official.
Once there, users are presented with a fake interface almost identical to TikTok’s. Victims are prompted to log in or register to access “exclusive discounts.”
If accessed via mobile, the fake site may offer to download a modified TikTok app that visually mimics the official one but includes SparkKitty spyware.
This malware:
During checkout, scammers remove credit card options and force crypto payments.
Victims are directed to top up a fake TikTok wallet.
Payments are made using USDT or ETH, which are untraceable once sent.
In the end, users lose their money and give away sensitive data that can fuel future fraud.
The numbers are alarming:
This shows that ClickTok is not the work of amateurs — it’s a well-funded, globally organized operation.
(Source: BLEEPINGCOMPUTER)
While there are many types of malware, SparkKitty stands out due to its stealth and ability to steal data without detection.
This means that even cautious users can fall victim simply by installing a Trojanized app.
(Source: BLEEPINGCOMPUTER)
More info: Hacker Leaks TikTok Passwords of Mexican Users on Telegram
You may wonder how so many users fall for scams like this. The answer lies in social engineering.
Attackers are skilled at manipulating:
In a fast-paced environment like TikTok Shop, where purchases are impulsive and dynamic, it’s easy to let your guard down.
(Source: BLEEPINGCOMPUTER)
At TecnetOne, we recommend taking these steps to stay safe:
Before entering your credentials, check the URL carefully. Typos or suspicious extensions like .icu, .top, or .shop are red flags.
Never install apps from links, QR codes, or messages. Use Google Play or the Apple App Store only.
If it looks too cheap or exclusive, it probably is a scam.
A next-gen EDR or antivirus like Sophos Intercept X can detect and block spyware like SparkKitty before it does damage.
Use wallets with clipboard protection and avoid storing private keys on your device.
Even if your password is stolen, MFA adds an extra layer of protection.
Cybercrime evolves quickly. Subscribe to threat intelligence newsletters or trust partners like TecnetOne to keep you updated.
Also of interest: TikTok Videos Spread Infostealer Malware in ClickFix Attacks
If you operate a store or are part of the TikTok Shop ecosystem, you play a vital role in prevention:
Remember: your reputation is at stake. A scammed customer may lose trust in your business, even if you weren’t directly responsible.
ClickTok is a clear example of how far cybercriminals will go to steal your data and money. Combining phishing, fake apps, and spyware, this campaign has already impacted thousands of users globally — and you could be next if you don’t take action.
At TecnetOne, we believe that awareness is your first line of defense. Now that you understand how this scam operates, you can better recognize the red flags and protect yourself.
Don’t wait until you become a victim: secure your devices, double-check what you install, and trust advanced cybersecurity solutions to keep you safe.