TikTok Flaw: A Simple Message Was Enough to Hack an Account

A vulnerability in TikTok's code allowed cybercriminals to take over verified accounts. The attack vector? A single private message. The flaw has since been fixed by ByteDance, the platform's parent company.

This article will also interest you: How to hack a TikTok account?

A cyberattack of disarming simplicity

According to information reported by Forbes, the attack succeeded as soon as the target opened a message.

No further action was required:

• no need to download a file;
• no need to click a fraudulent link;
• no need to be redirected to a phishing page.

The message was designed to spread malware directly onto the victim's smartphone. Once installed, the program took control of the TikTok account without the user having to approve anything.

The technical details of the exploit have not been made public. It is also unknown whether the flaw affected every version of the app, on Android as well as on iOS.

Which accounts were hit?

The attackers targeted high-profile accounts. Among the confirmed victims:

• Paris Hilton;
• Sony;
• CNN.

The cybercriminals' motives remain unknown at this stage. No claim of responsibility and no ransom demand has been made public.

ByteDance's response

ByteDance quickly detected the attack against certain accounts. The company took steps to protect its users and says that very few accounts were compromised.

Alex Haurek, a TikTok spokesperson, told Forbes:

"Our security team is aware of a potential attack targeting a number of brand and celebrity accounts. We have taken steps to stop this attack and prevent it from happening in the future. We are working directly with the affected account owners to restore access, if necessary."

The vulnerability has since been fixed. In theory, it is no longer possible to hijack a TikTok account by sending a single private message.

Why is this flaw concerning?

This case illustrates a worrying shift in cyberattacks: the victim does not have to interact.

In most account takeovers, the user has to make a mistake:

• click a booby-trapped link;
• open a malicious attachment;
• install a suspicious app.

Here, simply opening a message was enough. This kind of attack, called zero-click in its most extreme form, sharply reduces what the user can do to defend themselves.

How to protect your TikTok account

Even though the flaw has been fixed, a few habits remain essential.

1. Update the app

Always install the latest version of TikTok available on the App Store or Google Play. Security patches are included there.

2. Turn on two-factor authentication (2FA)

Prefer an authenticator app rather than a code sent by SMS.

3. Be wary of unexpected messages

Even on a trusted platform, a private message can be malicious. Do not open it if it comes from an unknown or suspicious account.

4. Check your active sessions

Regularly review the devices connected to your account. Log out of any session you do not recognize.

5. Use a unique password

Avoid reusing the same password across several services. A password manager can help.

FAQ: common questions about the TikTok flaw

Did you have to click a link to be hacked?

No. Opening the message that contained the malicious code was enough. No click on a link and no download was required.

Is the flaw still active?

No. ByteDance has fixed the vulnerability. In theory, it is no longer possible to hijack an account with a single message.

Which accounts were targeted?

Celebrity and company accounts, including Paris Hilton, Sony, and CNN.

How many accounts were hacked?

TikTok says that very few accounts were compromised. The exact number has not been disclosed.

What should I do if my account was hacked?

Change your password immediately, turn on two-factor authentication, revoke unknown active sessions, contact TikTok support, and check posts and messages sent without your knowledge.

• Change your password immediately.
• Turn on two-factor authentication.
• Revoke unknown active sessions.
• Contact TikTok support.
• Check posts and messages sent without your knowledge.

Key takeaways

• A flaw in TikTok made it possible to take over an account with a single private message.
• The victim did not have to do anything: no click and no download.
• Celebrity and company accounts were compromised, including Paris Hilton, Sony, and CNN.
• ByteDance has fixed the vulnerability and says that very few accounts were affected.
• The attackers' motives remain unknown.
• Updating the app and turning on two-factor authentication remain the best protections.

This case is a reminder that a single interaction, sometimes an unintentional one, can be enough to compromise an account. Vigilance and regular updates remain essential.