Milk Dragon AiTM Kit Uses Real-Time OTP Relay and WebSocket Keylogging to Bypass MFA

Milk Dragon is a phishing kit designed to turn an attractive online bargain into a fast-moving payment fraud attempt. The operation, also known as NaiLong, has been active since October 2025 and uses fake retail offers to draw shoppers toward convincing checkout pages.

Rather than relying on alarming emails or delivery warnings, the campaign places malicious links in marketplace advertisements and native social media posts.

A shopper who clicks a steep discount can be taken to a fraudulent store that asks for card information, personal details, and payment verification.

Group-IB researchers identified the activity across 66 countries and found 258 phishing pages since October 2025. Researchers also recorded 36 financial-institution verification templates.

The scale matters because the kit is sold as a subscription service in Telegram communities, lowering the effort needed to run a convincing fraud campaign.

Group-IB said in a report shared with Cyber Security News (CSN) that it starts at 300 USDT a month, while operators receive updates and support for their own phishing infrastructure.

Milk Dragon AiTM Kit

The attack begins with advertisements offering unusually low prices for everyday goods, electronics, toys, fashion, or supermarket products. Some posts come from accounts that may use AI-generated material or purchased followers to build trust.

The result is a scam that can turn casual browsing into a costly, fully managed fraud session for unsuspecting shoppers.

After the click, victims land on a WordPress site made to resemble a genuine retailer. The site uses WooCommerce for checkout, but a malicious custom plugin called BytePress adds fake card and PayPal payment choices and connects it to an operator-controlled panel.

BytePress maintains a persistent Socket.IO WebSocket connection between the browser and the criminal backend. That live link allows the operator to change pages, display notices, and accept, reject, or block entered payment data while the victim remains on the checkout page.

More importantly, the connection streams what a victim types character by character, before a form is submitted. That real-time capture resembles the threat documented in live payment page fraud, where criminals can monitor card details and one-time codes as the session unfolds.

Once payment details are entered, Milk Dragon displays a fake loading screen and moves the victim to a counterfeit verification page.

The operator selects a template matching the authentication request from the real 3D Secure payment site, then captures and relays the one-time password to approve a fraudulent transaction or take over an account.

Social Commerce Lures Expand Fraud Risk

This approach exploits the fact that people often browse social platforms casually and may not expect an advertisement to lead to fraud. Offers are framed around fear of missing out instead of the urgency used in conventional phishing, making them look like ordinary shopping opportunities.

The panel centralizes visitor information, card records, order details, and campaign statistics. It supports multiple phishing pages from one backend, role-based accounts, and browser or Telegram notifications.

Its use of reusable templates also lets criminals adapt the same workflow for particular regions and banks. This reflects a broader shift toward phishing-as-a-service kits that relay authentication in real time, a technique explained in PhaaS MFA bypass campaigns, rather than simply collecting static passwords.

For individuals, the safest response is to treat extraordinary discounts and unfamiliar social media shops as warning signs. Before entering payment data, independently verify the retailer and use trusted reputation services to check the link.

Anyone who shared card data or a code should contact their bank immediately and review transactions. Organizations should watch for lookalike domains and suspicious checkout patterns, then begin takedown activity before a campaign expands.

Monitoring emerging kits can identify reused infrastructure, while phishing-resistant authentication can reduce stolen OTP value. The case also reinforces why RCS and iMessage phishing and social media shopping scams require verification habits that extend beyond email.

Milk Dragon combines social commerce lures with operator-led credential capture. The source material does not publicly disclose campaign indicators of compromise, so no IoC table is included.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC