Fake brand discounts on social media prey on shoppers’ fear of missing out
Group-IB details the Milk Dragon phishing kit using fake social-media discounts to steal payment cards and 3DS one-time passwords across 66 countries.
Group-IB reports the Milk Dragon (NaiLong) phishing kit has run 258 pages impersonating 21 brands across 66 countries since October 2025, luring victims through fake discount posts in Facebook and TikTok marketplace listings rather than urgency-based scams. The kit's BytePress plugin adds fake card and PayPal checkout options to WooCommerce shops and streams every keystroke to the operator's C2 over a WebSocket connection before submission. Operators then relay 3D Secure one-time passwords to approve fraudulent transactions, and the affiliate panel stores reusable victim profiles with templates impersonating 36 financial institutions.
- 258 phishing pages in 66 countries impersonate 21 brands since October 2025
- BytePress plugin streams victim keystrokes live to operator C2
- Attackers relay 3DS one-time passwords to approve fraudulent transactions
- Affiliate panel stores reusable victim profiles; templates for 36 banks
- Organizations
- Group-IBMilk Dragon
From the original article
3 min read at helpnetsecurity.com
Cybercriminals are using fake discounts posted on Facebook and TikTok to lure shoppers to phishing sites that steal their payment card details and one-time passwords, Group-IB has warned. The phishing kit called Milk Dragon (also known as NaiLong) has been active since October 2025, and is linked to 258 phishing pages and victims in 66 countries.
By Sinisa Markovic · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.