TikTok Business Account Takeover via AitM Phishing and CAPTCHA Evasion

A recent campaign leverages adversary-in-the-middle (AitM) phishing infrastructure to compromise TikTok for Business accounts by combining credential interception with anti-analysis controls.

The attack flow begins with social engineering designed to drive user interaction. Victims are directed to attacker-controlled infrastructure that impersonates either TikTok for Business authentication flows or recruitment-style portals mimicking legitimate corporate workflows. These pretexts increase engagement rates and reduce suspicion, particularly when combined with contextual elements such as scheduling interfaces or onboarding narratives.

A key technical component of the campaign is the use of a CAPTCHA challenge (Cloudflare Turnstile) as a gating mechanism. This serves multiple purposes:

Prevents automated security crawlers and sandbox environments from accessing the malicious payload Filters traffic to prioritize real user interaction Delays exposure of the phishing content until basic human verification is completed

Once the challenge is solved, the victim is proxied through an AitM framework. This infrastructure operates as a transparent relay between the user and the legitimate service, capturing authentication material in real time. Unlike traditional credential harvesting pages, AitM setups can intercept:

Session cookies Authentication tokens Multi-factor authentication (MFA) responses

This allows attackers to establish authenticated sessions without requiring persistent access to credentials, effectively bypassing MFA protections.

The phishing kits used in these operations are consistent with modern, modular AitM toolkits that dynamically generate target-specific templates and handle session replay. These kits often integrate TLS certificates and domain fronting techniques to improve legitimacy and reduce detection.

In parallel, a separate campaign demonstrates the continued evolution of initial access techniques through file-based delivery. This activity uses SVG (Scalable Vector Graphics) files as the initial vector. While typically treated as static image assets, SVG files can embed active content such as JavaScript, enabling execution when opened in compatible environments.

The infection chain in this case includes:

Delivery of a weaponized SVG attachment disguised as a business document Execution of embedded logic that triggers outbound network communication Retrieval of a secondary payload from a remote endpoint Execution of a compiled malware binary written in Go

The use of SVG provides several advantages:

Lower detection rates due to its classification as an image format Compatibility with multiple rendering environments (browsers, email clients) Ability to embed obfuscated script content

The retrieved payload exhibits characteristics aligned with ransomware-linked tooling, including overlaps in code structure and behavior with previously analyzed families. The use of Go as an implementation language further complicates analysis due to static compilation and cross-platform portability.

Across both campaigns, several themes emerge:

Increased reliance on traffic gating (CAPTCHA, filtering layers) to evade automated defenses Use of legitimate service impersonation combined with real-time proxying to defeat MFA Expansion of non-traditional file formats (e.g., SVG) as initial access vectors Modular, reusable infrastructure enabling rapid adaptation of phishing operations

These techniques reflect a shift toward blending user interaction requirements with layered evasion, making detection dependent on behavioral analysis rather than static indicators.