AitM Phishing Targets TikTok Business Accounts Using Cloudflare Turnstile Evasion

This article covers two phishing campaigns: one targeting TikTok for Business accounts via AitM techniques, and another using SVG attachments to deliver malware in Venezuela.

• •Attackers use adversary-in-the-middle (AitM) phishing pages impersonating TikTok for Business or Google Careers to steal credentials
• •Cloudflare Turnstile is abused to block bots and automated scanners from analyzing the malicious pages
• •TikTok has previously been used to distribute infostealers like Vidar, StealC, and Aura Stealer via ClickFix-style instructions
• •A separate campaign targets Venezuelan users with SVG file attachments disguised as invoices or receipts that download Go-based malware
• •The downloaded malware shares code overlap with BianLian ransomware samples identified in January 2024