Sources: TikTok accounts, including brands and celebs like CNN, Sony, and Paris Hilton, are being hacked via a zero-day exploit that only requires opening a DM
Context & Ripple Effects
This report follows TikTok’s earlier patched Android account-takeover vulnerability, which required a malicious link, and reporting on a large Turkish account compromise tied to a flaw TikTok reportedly knew about. The alleged DM-opening trigger represents a more frictionless attack path than a conventional phishing link.
The named targets span media, corporate, and celebrity accounts, showing that the reported campaign is not confined to one user segment. That makes account security a platform-trust issue for organizations whose identities and audiences are tied to their TikTok presence.
First-order effects
- CNN, Sony, Paris Hilton, and other reported targets face unauthorized-account-access risk, while TikTok must contain the exploit path and secure affected accounts.
- If merely opening a DM can trigger compromise, users cannot depend solely on avoiding suspicious links; routine messaging interaction becomes the immediate exposure point.
Second-order effects
- Brands and high-profile account operators are likely to tighten access controls around account managers and DM workflows while they assess whether their accounts were exposed.
- TikTok’s response will be judged against the subsequent reported fix for DM-based account hijacking, increasing pressure to show that remediation reaches both the vulnerability and affected users.
Third-order effects
- If this pattern persists, social platforms will need to treat direct-message clients as a higher-risk security surface, not simply a channel where users must detect phishing attempts.
- Repeated account-takeover reports could make demonstrable vulnerability response and recovery processes a larger part of platform trust for publishers, brands, and creators.
The trend: This is part of a broader shift in which messaging features become a primary account-security battleground for platforms with high-value public identities.