Cloudflare-hosted AiTM phishing pages impersonate TikTok for Business and Google sign-in flows. Pages block security bots, capture credentials for account takeover, and enable ad fraud and malvertising. Push Security links the cluster to bulk-registered NiceNIC domains created March 24 and notes Google Storage redirects and Cloudflare Turnstile protections.
Part of the PlainSec briefing for 2026-03-27