As reports emerge of a new TikTok app known internally as “M2” specifically designed for US users, McAfee warns that the transition period could create perfect conditions for cybercriminals to exploit unsuspecting consumers – including by distributing fake or malicious TikTok apps disguised as the real thing. Here’s what you need to know about the potential risks and how to stay protected.
A New App is Coming
According to reports from The Information, TikTok is reportedly building a new version of the app just for the United States that could launch as soon as September 5. This development comes as ByteDance faces pressure to sell TikTok’s US operations or face a ban under federal legislation. The existing TikTok app will be removed from US app stores on the same day the new US app launches, although Americans may be able to continue using the current app until March of next year.
The transition won’t be seamless. Transferring the profiles and content of current users to the new app could pose practical challenges, and such a move could also make it harder for American TikTok users to see content from users in other countries. This disruption period presents significant cybersecurity risks that users must be aware of.
Why This Transition is Happening
ByteDance has been on the clock to find a new owner for TikTok’s US operations since then-President Joe Biden signed the sale-or-ban law last year over national security concerns. The Chinese government has indicated it would block any transfer of TikTok’s algorithm, meaning any new, separate American TikTok would need its own algorithm, possibly built from the ground up. President Trump has stated there are wealthy buyers ready to purchase TikTok’s US operations, though ByteDance currently has until September 17 to sell the app or face a US ban.
The Cybercriminal Opportunity: Fake Apps in the Wild
The announcement of a new TikTok app creates a perfect storm for cybercriminals looking to exploit confused users during the transition period. Based on McAfee’s recent research into Android malware campaigns, we can expect to see a surge in fake TikTok apps appearing across various distribution channels.
How Criminals Will Likely Exploit the Transition
Drawing from our analysis of current malware trends, cybercriminals will likely leverage several tactics:
1. Timing Confusion: During the transition period when users are uncertain about which app is legitimate, scammers will capitalize on this confusion by distributing fake “new TikTok” apps through unofficial channels and app stores.
2. Sophisticated Impersonation: Cybercriminals are getting smarter, using development toolkits like .NET MAUI to create fake apps that look and feel like the real thing. Expect to see convincing fake TikTok apps that mirror the official design and functionality.
3. Advanced Evasion Techniques: These fake apps hide their code in binary files so it can’t be easily detected, letting them stay on your phone longer—stealing quietly in the background. The new TikTok transition provides perfect cover for such sophisticated malware.
Distribution Channels and Unofficial App Stores to Watch
These apps aren’t in the Google Play Store. Instead, hackers will likely share them on fake websites, messaging apps, and sketchy links in texts or chat groups. During the TikTok transition, be especially wary of:
- Links claiming to offer “early access” to the new US TikTok app
- Messages from friends or contacts sharing “leaked” versions of the new app
- Social media posts advertising alternative download sources
- Websites claiming to host the “official” new TikTok before its actual release
What These Fake Apps Could Steal
Based on recent malware campaigns we’ve analyzed, fake TikTok apps could potentially:
- Steal contacts, photos, and texts from the phone
- Request sensitive information like full name, phone number, birthdate, and even financial information
- Use encrypted channels to send stolen data so even if someone intercepted it, they couldn’t read it
- Install persistent malware that continues operating even after the legitimate app becomes available
Protecting Yourself During the Transition
To stay safe during this vulnerable period, follow these essential guidelines:
- Download Apps only from Official App Stores: Download apps only from official app stores like Google Play or the Apple App Store. When the new TikTok app launches, wait for official announcements and download only from these verified sources.
- Be Skeptical of Early Access Claims: Any app claiming to offer early access to the new TikTok before the official launch date should be treated with extreme suspicion.
- Verify Before You Click: Avoid clicking on links from strangers or untrusted sources. Even if the link appears to come from someone you know, verify through another communication channel before downloading.
- Use Comprehensive Mobile Security Software: Install security software like McAfee Mobile Security to catch threats in real-time and protect against malicious apps that might slip through other defenses.
- Check App Permissions Carefully: If a flashlight app wants access to your texts, that’s a red flag. Similarly, be suspicious if a social media app requests excessive permissions unrelated to its core functionality.
Staying Ahead of Evolving Threats
Hackers are getting creative, but you can stay one step ahead. These recent .NET MAUI-based threats are sneaky—but they’re not unstoppable. The key is maintaining vigilance and using comprehensive security tools that evolve with the threat landscape.
As we navigate the transition to a new TikTok app for US users, remember that cybercriminals will attempt to exploit every opportunity for confusion and uncertainty. By staying informed, using official download sources, and leveraging tools like McAfee’s Mobile Security, you can continue enjoying social media safely.
The digital landscape is constantly evolving, but with the right knowledge and tools, you can stay protected while enjoying the platforms you love. Whether you’re transitioning to a new TikTok app or simply want better control over your social media privacy, McAfee+ provides the comprehensive protection you need in today’s connected world.