Milk Dragon Phishing Kit Uses Facebook and TikTok Discounts to Steal Cards and Bypass MFA
Milk Dragon uses fake social-media discounts to steal cards and intercept 3-D Secure codes.
Group-IB reported that the Milk Dragon phishing-as-a-service kit, also called NaiLong, uses discounted Facebook and TikTok posts to send victims to fraudulent stores. Since October 2025 it has linked 258 pages to victims in 66 countries, with 36 banking templates and impersonation of 21 brands, including LEGO, Calvin Klein, and Aeon Malaysia. A malicious WordPress plugin, BytePress, inserts fake card and PayPal checkout options and streams entered data to operators, who proxy legitimate 3-D Secure challenges to capture codes. The kit has been sold on Telegram from 300 USDT per month with an operator panel and live session monitoring.
67