Milk Dragon (Malware): news timeline & CVEs

Milk Dragon AiTM Kit Uses Real-Time OTP Relay and WebSocket Keylogging to Bypass MFA

Group-IB says the Milk Dragon kit relays OTPs live to steal shoppers' card payments across 66 countries.

Group-IB reported that Milk Dragon, also called NaiLong, is a phishing-as-a-service kit active since October 2025. Marketplace ads and social posts send shoppers to fake WordPress and WooCommerce stores. The BytePress plugin opens a Socket.IO WebSocket that streams keystrokes and lets operators swap in 3D Secure templates to relay one-time passwords. Researchers counted 258 phishing pages and 36 bank templates across 66 countries; subscriptions start at 300 USDT a month on Telegram.

Cyber Security NewsOct 2, 09:56 UTC · 14h agoPhishing & fraud in the wild 2 sources

Milk Dragon Phishing Kit Uses Facebook and TikTok Discounts to Steal Cards and Bypass MFA

Milk Dragon uses fake social-media discounts to steal cards and intercept 3-D Secure codes.

Group-IB reported that the Milk Dragon phishing-as-a-service kit, also called NaiLong, uses discounted Facebook and TikTok posts to send victims to fraudulent stores. Since October 2025 it has linked 258 pages to victims in 66 countries, with 36 banking templates and impersonation of 21 brands, including LEGO, Calvin Klein, and Aeon Malaysia. A malicious WordPress plugin, BytePress, inserts fake card and PayPal checkout options and streams entered data to operators, who proxy legitimate 3-D Secure challenges to capture codes. The kit has been sold on Telegram from 300 USDT per month with an operator panel and live session monitoring.

GBHackersupdated Oct 2, 09:56 UTC · 14h agofirst Oct 2, 08:51 UTC · 15h agoPhishing & fraud in the wild 2 sources

Milk Dragon

Timeline2 articles

Appears with

Milk Dragon AiTM Kit Uses Real-Time OTP Relay and WebSocket Keylogging to Bypass MFA

Milk Dragon Phishing Kit Uses Facebook and TikTok Discounts to Steal Cards and Bypass MFA