What happened
Between May and September 2026, a fake TikTok Shop phishing site generated more than 320 000 blocks globally, representing about 19 % of all phishing blocks reported by Surfshark. The domain remained active into October, staying the top‑blocked phishing site for the first 20 days of the month. Although protected devices grew 241 %, blocks per device rose 83 %, showing the scam’s effectiveness rather than just user growth. The threat is expected to intensify ahead of the Black Friday shopping period.
Why it matters for trust and compliance
- The incident highlights the need for effective phishing‑detection controls and ongoing security‑awareness training—core control objectives that map to multiple frameworks such as NIST CSF 2.0 and ISO 27001.
- Provides concrete evidence of phishing activity for audit‑ready control monitoring.
- Demonstrates the value of continuous security‑awareness training to mitigate social‑engineering risk.
Who is affected
Retail/e‑commerce platforms Online shoppers
Recommended actions
- Deploy anti‑phishing web filters or secure DNS and integrate block metrics into audit evidence.
- Refresh security‑awareness training with current phishing examples and verification best practices.