Cybersecurity Threat Advisory: Milk Dragon Phishing Kit Uses Fake Social Media Deals to Steal Cards and One-Time Passcodes

Threat update

A phishing kit called Milk Dragon (also known as NaiLong) is being sold to criminals as a subscription service, and it is built for one job: turning a "too good to be true" social media deal into a fraudulent card charge. Victims click a discount ad on Facebook or TikTok, land on a cloned store that looks like a brand they trust and enter their card details. The kit then grabs the one-time passcode their bank sends and uses it on the spot. Your business is exposed in two ways. Employees may shop on these sites with company cards, and your own brand could be the one being copied.

Technical Detail and Additional Info

What is the threat?

Group-IB researchers published their analysis of Milk Dragon on October 1, 2026. The kit has been active since October 2025 and is sold on Telegram as Phishing-as-a-Service (PhaaS), starting at 300 USDT (roughly $300) a month. Buyers get the tools, updates, and support. They don't need to know how to build anything.

Here's how a typical attack plays out:

• The bait: Attackers post ads and marketplace listings on Facebook and TikTok offering steep discounts on names like LEGO and Calvin Klein. Some of the accounts behind these posts use AI-generated content or purchased followers to look legitimate.
• The fake store: The link leads to a WordPress and WooCommerce site made to look like the real brand's shop. A malicious plugin called BytePress adds fake credit card and PayPal checkout options.
• Live keystroke capture: BytePress keeps an open connection to the attacker's control panel and streams what the victim types as they type it. The operator watches in real time and can accept, reject, or redirect the victim at any point.
• The passcode relay: After the card is entered, the victim sees a fake verification page that mimics their bank's 3D Secure check. The kit carries templates for 36 financial institutions. When the bank sends a real one-time passcode, the victim types it into the fake page and the attacker uses it to approve a fraudulent purchase or take over the account. This is the adversary-in-the-middle (AiTM) piece.
• The cover-up: Finally, the victim gets a fake order confirmation. Thinking the purchase went through, they don't call their bank, which buys the attacker time.

Why is it noteworthy?

Most phishing defenses are built around email. Milk Dragon skips email entirely and go where people already shop and scroll. Spam filters never see it.

It also defeats the extra security step that many people assume protects them. A one-time passcode is only as safe as the page you type it into, and here the attacker is sitting in the middle of that exchange, using each code within seconds. The lure is different, too. Instead of the "your account is locked" panic common to most phishing, Milk Dragon plays on fear of missing out on a deal, which tends to lower people's guard.

And because it's sold as a service, the barrier to entry is low. Group-IB has tied it to 258 phishing pages and victims in 66 countries so far, with activity concentrated in Malaysia, Singapore, and Thailand. A subscription model like this can be pointed at new regions and new brands quickly.

What is the exposure or risk?

Consumers are the main target, but businesses are pulled in when:

• Employees use company credit cards or work email addresses for online purchases
• Staff browse social media marketplaces on work devices without web filtering
• Your brand is popular enough to be copied for fake storefronts or ads
• Card and payment verification relies only on one-time passcodes sent by text or email

The fallout can include:

• Fraudulent charges on corporate cards and time lost to disputes and card replacement
• Exposure of employee personal data and work email addresses for follow-up attacks
• Customers defrauded by fake stores carrying your name, followed by complaints and support calls
• Damage to your brand's reputation and customer trust
• For financial institutions and payment processors, higher fraud losses from relayed 3D Secure codes

What are the recommendations?

 LBT Technology Group recommends the following actions:

• Train staff to spot fake deals. Add social media ads and marketplace scams to your security awareness training. Big discounts on name brands, unfamiliar web addresses, and unexpected verification prompts should all be treated as red flags.
• Verify before you buy. Encourage employees to go directly to a retailer's known website rather than clicking ads. Free tools such as urlscan.io, VirusTotal, and ScamAdviser can help check a site before card details go in.
• Tighten controls on company cards. Use virtual cards for online purchases, set spending limits, turn on real-time transaction alerts, and restrict purchases on unfamiliar sites. Make it clear that suspected fraud should be reported right away, even if an order "confirmation" arrived.
• Filter web traffic. DNS filtering and secure web gateways backed by threat intelligence can block known phishing domains and flag newly registered sites before anyone enters data.
• Watch for brand impersonation. If you sell online, monitor for lookalike domains, fake storefronts, and fraudulent social accounts using your name or logo, and request takedowns early.
• Move beyond passcode-only verification. Where you have the option, especially for finance and high-risk users, use phishing-resistant methods like FIDO2 security keys or passkeys instead of codes sent by text or email.
• Act fast if someone was caught. Contact the card issuer immediately to cancel the card and dispute charges, change any passwords entered on the fake site, and watch the affected accounts closely.

Want to know whether your web filtering, payment controls, and security training would catch a scam like this? Contact LBT Technology Group for a no-pressure security review.

References

 For more in-depth information about the recommendations, please visit the following links:

• Tan, Brandon, Tsai Shun Ling, and Viacheslav Shevchenko. "Milk Dragon (NaiLong) phishing kit." Group-IB, October 1, 2026.
• Dutta, Tushar Subhra. "Milk Dragon AiTM Kit Uses Real-Time OTP Relay and WebSocket Keylogging to Bypass MFA." Cyber Security News, October 2, 2026.
• SC Staff. "Milk Dragon scam uses fake deals on social media to steal payment data." SC Media, October 5, 2026.