Researcher flags tik-tok-18-2/3/4.cc sites pushing Android malware posing as adult TikTok
Researcher @masaomi346 says tik-tok-18-2.cc, tik-tok-18-3.cc and tik-tok-18-4.cc distribute Android malware posing as an adult TikTok app.
- First reported
- Reports
- 1
Source: x.com · published
What happened
On 5 November 2026 the security researcher @masaomi346 posted on X that tik-tok-18-2.cc, tik-tok-18-3.cc and tik-tok-18-4.cc were distributing Android malware disguised as an adult TikTok app. The post used Japanese phishing and malware hashtags. These domains are not operated by TikTok.
How the scam works
Adult-content lures are a common way to push people into installing APK files from websites rather than from the official app store. The visitor is told to download an app to watch videos; the site asks Android to allow installs from unknown sources; and the installed app may then abuse SMS, accessibility or other permissions.
TikTok distributes its apps through official stores and its own verified channels, not through randomly numbered .cc domains. Anyone who installed an app from these sites should disconnect the phone, uninstall the app, remove any elevated permissions, and change passwords from another device. If SMS codes may have been read, banks and card issuers should be notified. The domains come from the researcher's post and have not been independently checked by scammers.com.
TikTok-branded malware campaigns often rotate through many short-lived numbered domains such as tik-tok-18-2.cc through tik-tok-18-4.cc so that blocklists lag behind. Treat any adult-app download outside Google Play or the Apple App Store as hostile, even if the page looks polished. If friends received similar links from your device after an install, assume the malware may have used your contacts and warn them not to tap the messages.
Source
Post by @masaomi346 on X, 5 November 2026, flagging tik-tok-18-2.cc and related domains. Not independently verified by scammers.com.
Red flags
- Domains such as tik-tok-18-2.cc that are not TikTok's official sites.
- An adult TikTok app offered as a direct APK download.
- A request to allow installs from unknown sources.
- An app asking for SMS, accessibility or device-administrator access.
- Pressure to install quickly to unlock videos.
If you were targeted
- 1Do not install APKs from websites; use the official app store.
- 2Keep install unknown apps switched off on Android.
- 3If you installed the app, disconnect, uninstall and remove elevated permissions.
- 4Change passwords from another device and tell your bank if SMS codes may have been read.
- 5Report the domains to TikTok and your mobile carrier.