TikTok has reportedly made moves to block a zero-day or previously undiscovered exploit that resulted in several high-profile accounts belonging to companies and celebrities getting hijacked over the last week.

The first reported account takeover was a CNN account last week. Forbes reported earlier today that other accounts affected include those belonging to Paris Hilton and Sony Group Corp.

The account takeovers involve malware sent through direct messages within the TikTok app. The malware in question is said to not require a download, click, response or any other act from users beyond opening the message. The motivation behind the account takeovers is also not clear, as the attacker, having gained control of the affected accounts, did not post or do anything else with them.

Although the total number of accounts affected is not clear, TikTok officially says only a small number were affected.

“Our security team is aware of a potential exploit targeting a number of brand and celebrity accounts,” a spokesperson for TikTok told Forbes. “We have taken measures to stop this attack and prevent it from happening in the future. We’re working directly with affected account owners to restore access if needed.”

The spokesperson added that TikTok had been working directly with CNN to restore account access and to “implement enhanced security measures to safeguard their account moving forward.”

The security issue is not TikTok’s first. A hacker claimed to have stolen user data and source code in 2022. TikTok denied the claim, with reports at the time noting that the allegedly stolen data may have been gathered by a third-party data scraper or broker who scrapped publicly available data.

Discussing the news, Ray Kelly from the Synopsys Software Integrity Group told SiliconANGLE that the incident is reminiscent of a 2005 attack on MySpace called “Samy Worm.”

“That event was the first widely known instance of a self-propagating worm on a social media platform and underscored the critical importance of input validation in web applications,” Kelly said. “While the MySpace hacker was merely having some fun by posting his malware via status updates, the TikTok actors seem to have more malicious intentions, aiming to take over accounts and wreak havoc on high-profile users using DMs to propagate the malware.”

Photo: Hermann Luyken/Wikimedia Commons