TikTok fixes zero-day bug used to hijack high-profile accounts
Over the past week, attackers have hijacked high-profile TikTok accounts belonging to multiple companies and celebrities, exploiting a zero-day vulnerability in the social media's direct messages feature.
Zero-day vulnerabilities are security flaws with no official patch or public information detailing the underlying weakness.
After being compromised, user accounts belonging to Sony, CNN, and Paris Hilton had to be taken down to prevent abuse. CNN's account was the first to be hijacked last week, as Semaphor first reported on Sunday.
As Forbes reported today, the exploit used by the attackers to hack the accounts via DMs only needs the targets to open the malicious message and doesn't require downloading a payload or clicking embedded links.
"Our security team is aware of a potential exploit targeting a number of brand and celebrity accounts," TikTok spokesperson Alex Haurek told Forbes.
"We have taken measures to stop this attack and prevent it from happening in the future. We're working directly with affected account owners to restore access, if needed."
According to Haurek, the attackers have only compromised a very small number of TikTok accounts. The company has yet to reveal the exact number of impacted users and has not shared any details regarding the exploited vulnerability until the underlying flaw is fixed.
Not the first flaw allowing account takeovers
This isn't the first vulnerability to impact TikTok users in recent years. Most recently, the company patched an Android app flaw discovered by Microsoft in August 2022 that let hackers "quickly and quietly" take over accounts with one tap.
Previously, it fixed security bugs that allowed attackers to bypass the platform's privacy protections and steal private user information, including phone numbers and user IDs.
The company also fixed vulnerabilities that enabled threat actors to hijack the accounts of users who signed up via third-party apps and compromise accounts to manipulate the owners' videos and steal their personal information.
TikTok surpassed 1 billion users in September 2021, and it currently has over 1 billion downloads on Google's Play Store and 17 million ratings on the iOS App Store.
When contacted by BleepingComputer earlier today for more information on the number of compromised accounts and the vulnerability exploited in the attacks, a TikTok spokesperson was not immediately available for comment.
source: BleepingComputer
Free online web security scanner
Top News:

Black Basta ransomware gang's internal chat logs leak online
February 20, 2025
Cisco Confirms Salt Typhoon Exploited CVE-2018-0171 to Target U.S. Telecom Networks
February 21, 2025
SonicWall firewall bug leveraged in attacks after PoC exploit release
February 14, 2025
CISA Flags Craft CMS Vulnerability CVE-2025-23209 Amid Active Attacks
February 21, 2025
SpyLend Android malware downloaded 100,000 times from Google Play
February 21, 2025