Sources: TikTok accounts, including brands and celebrities like CNN and Paris Hilton, are getting hacked via a zero-day exploit that only requires opening a DM
The compromised accounts include CNN and Paris Hilton — and all users have to do to be hacked is open a DM. X: @ebakerwhite See also Mediagazer X: Emily Baker-White / @ebakerwhite : Update: we've learned that an official Sony account has also been affected. https://www.forbes.com/... See also Mediagazer
Context & Ripple Effects
The reported compromises span a news organization, an entertainment figure and, in follow-up coverage, an official Sony account, indicating that high-visibility accounts—not a single creator category—were exposed. TikTok later said it had fixed the account-hijacking vulnerability, making this report the incident phase of a short security-response arc.
The episode also follows a prior patched TikTok Android account-takeover flaw tied to malicious links. That history matters because direct-message interactions remain a recurring route through which ordinary platform features can become account-security exposure.
First-order effects
- CNN, Paris Hilton and Sony face immediate account-integrity and reputational risk: a compromised verified account can distribute unauthorized posts or messages to established audiences.
- TikTok must contain the exploit and assess affected accounts; users and account managers cannot treat an unsolicited DM as a routine low-risk interaction while the flaw is active.
Second-order effects
- Brands, media organizations and talent teams are likely to tighten controls around social-account access and DM handling, adding operational friction for teams that use the channel for outreach.
- The incident raises the value of platform-side defenses that limit malicious-message delivery and detect abnormal account actions, rather than placing the security burden solely on account holders.
Third-order effects
- If message-triggered takeover flaws continue to surface, direct messaging will be treated less as a benign engagement feature and more as a core attack surface requiring ecosystem-wide safeguards.
- High-profile account security is likely to become a platform-trust differentiator: failures can affect not only individual users but also the institutional publishers and brands that depend on social channels.
The trend: Social platforms are moving toward ecosystem cyber defense as messaging, identity and distribution converge into a single account-takeover surface.