Don't download this TikTok app — it's spyware

News
By published

Bogus 'TikTok Pro' app steals passwords, reads your texts

(Image credit: Kon Karampelas)

President Trump and tech experts worry that TikTok might be spyware, but a fake "TikTok Pro" Android app is the real thing. It will steal your text messages, your photos, your location and your Facebook password, and can take screenshots, tap into your microphone, make calls, send texts and launch other apps. 

The TikTok Pro app isn't in the Google Play Store, but because the U.S. government has declared it will ban TikTok unless the Chinese app finds an American buyer, many people may be forced to go "off-road" looking for the real thing. TikTok Pro will be waiting to trick them into downloading it.

"Users looking forward to using the TikTok app amidst the ban might look for alternative methods to download the app," wrote Shivang Desai of security firm ZScaler in a blog post yesterday (Sept. 8) detailing this new spyware threat. "In doing so, users can mistakenly install malicious apps."

This isn't the first fake "TikTok Pro" app to appear — Desai noted that an earlier one was promoted via WhatsApp and text-message spam and, once installed, showed you a lot of ads. That one was more annoying than it was harmful. 

Desai didn't specify how this new, more dangerous variant was propagating, but the same avenue of texts and message chats might be a safe bet.

Once the fake TikTok app is installed, it quickly hides its own icon, Desai wrote, possibly to make the user think the installation failed. To steal your Facebook credentials, it creates a fake Facebook login page and waits for you to type in your username and password.

"This functionality can be easily further extended to steal other information, such as bank credentials, although we did not see any banks being targeted in this attack," Desai wrote.

It's pretty easy to avoid "TikTok Pro" and other malicious Android apps. First, don't download or install any app that's not in the official Google Play app store. (Older Android phones can prevent this by leaving "Unknown sources" unchecked in the security settings.) 

Second, do download and install one of the best Android antivirus apps, which will block such Android malware right away.

Paul Wagenseil
Paul Wagenseil

Paul Wagenseil is a senior editor at Tom's Guide focused on security and privacy. He has also been a dishwasher, fry cook, long-haul driver, code monkey and video editor. He's been rooting around in the information-security space for more than 15 years at FoxNews.com, SecurityNewsDaily, TechNewsDaily and Tom's Guide, has presented talks at the ShmooCon, DerbyCon and BSides Las Vegas hacker conferences, shown up in random TV news spots and even moderated a panel discussion at the CEDIA home-technology conference. You can follow his rants on Twitter at @snd_wagenseil.