Milk Dragon AiTM Kit Uses Real-Time OTP Relay and WebSocket Keylogging to Bypass MFA
Group-IB says the Milk Dragon kit relays OTPs live to steal shoppers' card payments across 66 countries.
Group-IB reported that Milk Dragon, also called NaiLong, is a phishing-as-a-service kit active since October 2025. Marketplace ads and social posts send shoppers to fake WordPress and WooCommerce stores. The BytePress plugin opens a Socket.IO WebSocket that streams keystrokes and lets operators swap in 3D Secure templates to relay one-time passwords. Researchers counted 258 phishing pages and 36 bank templates across 66 countries; subscriptions start at 300 USDT a month on Telegram.
68