Milk Dragon Phishing Kit Uses Fake Social Media Discounts to Steal Cards and OTPs
Summary
Group-IB says the Milk Dragon kit uses fake Facebook and TikTok discounts to direct shoppers to stores that capture payment card details and one-time passwords, with 258 phishing pages linked to victims in 66 countries.
Key points
- Active since October 2025, Milk Dragon is linked to 258 phishing pages and victims in 66 countries.
- Fake social media marketplace listings impersonate 21 brands to lure shoppers with steep discounts.
- The fake stores use a custom BytePress plugin alongside WooCommerce to add counterfeit card and PayPal checkout options.
- A persistent WebSocket connection sends payment-page keystrokes to operators in real time and lets them control the checkout flow.
- Operators use spoofed 3D Secure verification pages to capture OTPs and approve fraudulent transactions or take over accounts.
- The panel stores payment and personal data, sends alerts through Telegram, and supports templates impersonating 36 financial institutions.
- Group-IB advises shoppers to avoid suspicious discounts and contact their bank immediately if they submitted card details.
Article Details
- Attack Vectors
- Fake discount ads and marketplace listings on Facebook and TikTok direct shoppers to phishing storefronts.
- The storefronts use a custom BytePress plugin to capture payment-card details as victims type them and to present spoofed verification pages that collect one-time passwords.
- Operators relay stolen one-time passwords to approve fraudulent transactions or take over accounts.
- Defensive Notes
- Be wary of social-media ads and third-party links, and treat steep or time-limited discounts as warning signs.
- Anyone who entered card details on a suspected phishing site should contact their bank or card issuer immediately.
- Companies should monitor for lookalike domains, request takedowns early, and watch for suspicious card activity and unusual checkout patterns.
MITRE ATT&CK
T1056.003 · Web Portal CaptureThe BytePress checkout captures payment details character by character, and spoofed verification pages collect victims’ one-time passwords.T1566.003 · Spearphishing via ServiceOperators post malicious links in social-media marketplace listings to direct shoppers to phishing storefronts.
Products
FacebookGroup-IB has warned that cybercriminals are using fake discount ads on Facebook and TikTok to drive shoppers to phishing sites that steal payment card details and one-time passwords.TelegramOperators use a panel and Telegram alerts to manage stolen data and monitor victims in real time.TikTokGroup-IB has warned that cybercriminals are using fake discount ads on Facebook and TikTok to drive shoppers to phishing sites that steal payment card details and one-time passwords.WooCommerceThe shop runs on WooCommerce, a legitimate e-commerce plugin, alongside a custom plugin called BytePress that adds a fake credit card option and a fake PayPal option to the checkout.WordPressOnce victims engage with the malicious ad or post, they are redirected to a WordPress site disguised as an online retailer selling discounted products.
Tools
BytePressThe checkout page captures card data and OTPs through a custom BytePress plugin.Milk DragonThe Milk Dragon phishing kit, also known as NaiLong, has linked thousands of fake shopping pages across 66 countries by impersonating brands such as LEGO, Calvin Klein, and Aeon Malaysia.NaiLongThe Milk Dragon phishing kit, also known as NaiLong, has linked thousands of fake shopping pages across 66 countries by impersonating brands such as LEGO, Calvin Klein, and Aeon Malaysia.