Researcher @masaomi346 says tik-tok-18-app-5.top distributes Android malware posing as an adult TikTok app. TikTok is not involved.
Source: x.com · published
On 9 November 2026 the Japanese security researcher @masaomi346 posted on X that hxxps://tik-tok-18-app-5[.]top/ poses as an adult version of TikTok and distributes Android malware. The post linked a VirusTotal file report and tagged it #Phishing and #malware. The site is not operated by TikTok, and TikTok is not involved.
The researcher's screenshot shows a mobile page branded VibeVideo with an 18+ badge, Japanese text telling visitors to enjoy the rest of the content in an app, and a button to download a free Android APK. Installing that file means allowing installs from unknown sources, which bypasses the checks that Google Play applies.
Adult or unlocked versions of popular apps are a common lure for malware. Apps spread this way have commonly been reported to request accessibility or SMS permissions, read one-time codes, overlay fake login screens on banking apps or send further scam links from the phone. The VirusTotal sample linked in the post lets security tools detect the file.
Install TikTok only from Google Play or the App Store. Anyone who installed an APK from this site should switch the phone to airplane mode, uninstall the app, remove any accessibility or device-administrator rights it was given, and change banking and email passwords from another device. The details come from the researcher's post and have not been independently checked by scammers.com.
Genuine TikTok never asks you to install an APK from a third-party website. If a page promises adult content that is only available after a free Android download, treat that download as untrusted malware until proven otherwise.
Post by @masaomi346 on X, 9 November 2026, flagging tik-tok-18-app-5.top. Not independently verified by scammers.com.
Security researcher @masaomi346 posted on X on 12 November 2026 about Android malware impersonating Rakuten (楽天), the Japanese e-commerce and financial services group, linking a VirusTotal analysis of the sample. The…
Security researcher @KesaGataMe0 posted on X on 12 November 2026 a list of sites labeled as malware distribution impersonating SMBC / SMCC / Sumitomo Mitsui Card (三井住友カード), all at IP 8.216.50.3 (AS45102, Alibaba (US)…
Security researcher @KesaGataMe0 posted on X on 12 November 2026 that hxxps://smbc[.]hocxiu[.]com/ is a phishing site impersonating SMBC (Sumitomo Mitsui Banking Corporation, 三井住友銀行), served through Cloudflare (AS1333…
Phishing tracker @phishunt_io posted on X on 12 November 2026 that itau-unibanco[.]sbs is an Itaú (Itaú Unibanco, the Brazilian bank) phishing site. According to the post, the domain was registered on 10 November 2026…
Security researcher @catnap707 posted on X on 12 November 2026 about fake websites (偽サイト) impersonating the Tokyo Metropolitan Police Department (警視庁). The post lists the links jp[.]kdfz[.]net, jp[.]kstw[.]net, jp[.]k…
MalwareTips published an investigation today rating hervalife.com a high-risk store that belongs to a scam network of near-identical shops sharing templates, product photos and return policies and reopening under new…