Somewhere between the viral dances and algorithm-driven product recommendations, TikTok became one of the most consequential marketing platforms on earth. Brands pour millions into it. Influencers build empires on it. And now, cybercriminals are targeting the business accounts that power the platform’s commercial engine with a sophisticated phishing campaign that preys on one of the oldest fears in content creation: copyright infringement.
The attack is elegant in its simplicity. An email lands in the inbox of a TikTok business account holder, warning that their content has violated copyright policies — or, in some variants, offering the lure of a verified badge or an advertising partnership. The message looks official. The urgency feels real. One click leads to a credential-harvesting page. And just like that, an account with potentially millions of followers and significant advertising spend is compromised.
According to TechRadar, researchers at security firm Abnormal Security first identified the campaign, which has been sending phishing emails in two distinct waves. The attacks appear to be timed around periods of peak business activity, suggesting the threat actors understand the rhythms of digital marketing teams and the pressure they operate under.
Anatomy of the Attack: Copyright Panic as a Weapon
The phishing emails are crafted to trigger an immediate emotional response. Copyright takedowns on TikTok can mean account suspension, loss of monetization, and destruction of audience reach built over months or years. The attackers know this. They’re weaponizing it.
In one variant, the email claims the recipient’s account has been flagged for copyright violation and demands they verify their identity through an embedded link. Another version dangles the promise of TikTok’s coveted blue verification badge. A third poses as an advertising opportunity. All three converge on the same goal: stealing login credentials and, critically, bypassing two-factor authentication.
That last point matters enormously. The phishing pages don’t just ask for usernames and passwords. They also request one-time passcodes — the very codes generated by authenticator apps or sent via SMS that are supposed to serve as the last line of defense. If a victim enters that code in real time, the attackers can use it immediately to access the account before the code expires. It’s a man-in-the-middle approach that renders standard 2FA protections nearly useless against an engaged, real-time adversary.
Abnormal Security’s researchers noted that the emails were sent from addresses designed to mimic TikTok’s official communications, often using domains that appeared legitimate at first glance but contained subtle misspellings or extra characters. The messages were composed in professional language, free of the grammatical errors that once made phishing attempts easy to spot. These aren’t the clumsy Nigerian prince scams of two decades ago. Not even close.
The campaign specifically targets accounts classified as business or advertising accounts — the ones with credit cards on file, the ones managing paid campaigns, the ones with the most to lose. This is a deliberate choice. Compromising a personal account with 500 followers yields little. But taking over a brand account with an active ad budget and hundreds of thousands of followers? That’s a payday.
Once inside, attackers can redirect advertising spend, lock out legitimate owners, sell access to the account on dark web marketplaces, or use the account’s credibility to launch further scams against its followers. The downstream damage multiplies fast.
Recent reporting from BleepingComputer has highlighted a broader trend of social media account takeovers accelerating in 2025, with TikTok joining Instagram, YouTube, and X as prime targets. The common thread across platforms: phishing campaigns that exploit the specific anxieties of content creators and business users. Copyright strikes. Verification promises. Partnership offers. The bait changes; the hook stays the same.
Why TikTok Business Accounts Are Particularly Vulnerable
TikTok’s explosive growth as a commercial platform has created a target-rich environment. The company reported over 15 million business accounts globally as of late 2024, and that number has only grown. Many of these accounts are managed by small marketing teams or individual creators who lack dedicated cybersecurity resources. They’re running content calendars, not security operations centers.
And the platform’s own communication practices contribute to the problem. TikTok regularly sends legitimate emails about policy updates, content moderation decisions, and account status changes. Users are conditioned to respond to these messages. When a phishing email arrives that looks and sounds like the real thing, the instinct is to click first and question later.
So what makes this campaign different from garden-variety phishing? Scale and precision. The attackers aren’t casting a wide net hoping to catch random users. They’re targeting specific account types with tailored messages that reference real TikTok features and policies. The copyright violation variant, for instance, often includes language that mirrors TikTok’s actual community guidelines notifications. It’s social engineering refined to an industrial grade.
There’s also the timing factor. Abnormal Security observed that phishing waves coincided with periods when TikTok was actively rolling out policy changes and new business features. During these windows, users are more likely to expect official communications and less likely to scrutinize incoming messages. The attackers are reading the same tech news as everyone else and calibrating their campaigns accordingly.
The financial implications are significant. A compromised business account with an active advertising budget can see thousands of dollars redirected before the breach is even detected. Account recovery through TikTok’s support channels is notoriously slow, sometimes taking weeks. During that time, brands lose access to their audience, their advertising investment, and potentially their reputation if the compromised account is used to post malicious or embarrassing content.
For agencies managing multiple client accounts, the risk compounds. A single compromised credential can cascade across an entire portfolio if password reuse is involved — and despite years of security awareness training, password reuse remains stubbornly common.
The broader context here is a cybersecurity environment where social media accounts have become high-value targets in their own right. They’re not just communication channels anymore. They’re revenue-generating assets, brand equity repositories, and customer acquisition engines. Losing one isn’t a minor inconvenience. It’s a business crisis.
Defending Against the Threat: What Actually Works
The standard advice — don’t click suspicious links, enable two-factor authentication, verify sender addresses — remains valid but insufficient. This campaign specifically defeats basic 2FA by capturing codes in real time. That changes the calculus.
Security experts recommend migrating to hardware security keys (like YubiKeys) for any account with significant business value. Unlike SMS codes or authenticator app tokens, hardware keys use cryptographic protocols that can’t be phished through fake login pages. The key must be physically present and connected to the device performing the authentication. A fake website can’t intercept what it can’t replicate.
But hardware keys require organizational commitment. They cost money. They need to be distributed, managed, and backed up. For a small business running its TikTok marketing with a team of two, this can feel like overkill. It isn’t — but the friction is real.
More immediately actionable: establish a verification protocol for any email requesting account action. If an email claims your TikTok account has a copyright strike, don’t follow the email’s link. Open a fresh browser tab, go directly to TikTok’s website, and check your account status there. If there’s a real issue, it’ll be visible in your account’s notification center. This one habit defeats the vast majority of phishing attempts.
Organizations should also implement email filtering solutions that can detect domain spoofing and flag messages from addresses that closely resemble — but don’t exactly match — legitimate corporate domains. Tools from companies like Abnormal Security, Proofpoint, and Mimecast are specifically designed for this kind of threat detection.
And here’s an uncomfortable truth: the human element remains the weakest link. Training helps, but it doesn’t eliminate risk. People are busy. They’re stressed. They see an urgent email about their account being suspended and they react. Building organizational cultures where employees feel comfortable pausing to verify — without fear of being seen as slow or paranoid — is arguably more important than any technical control.
TikTok itself has published guidance urging users to be wary of unsolicited emails and to report suspicious messages. But the platform has been criticized for its slow account recovery processes and limited direct support for business users dealing with compromises. As the platform continues to grow its advertising business, improving these response capabilities isn’t optional. It’s a competitive necessity.
The phishing campaign targeting TikTok business accounts isn’t an isolated incident. It’s a symptom of a larger shift in how cybercriminals think about value. Social media accounts are assets. They have measurable worth — in followers, in ad spend, in brand equity. And where there’s value, there are thieves.
For the millions of businesses that have built their marketing strategies around TikTok’s extraordinary reach, the message is clear. The platform that drives your growth can also be the vector for your compromise. Vigilance isn’t a one-time effort. It’s a daily practice.
WebProNews is an iEntry Publication