Cybersecurity firm Group-IB has detailed the operations of Milk Dragon, a phishing kit also tracked as NaiLong that lures online shoppers using fake brand discounts on social media platforms. Active since October 2025, the phishing framework has been linked to 258 phishing pages affecting victims across 66 countries.
Exploiting Social Media Bargain Hunters
Unlike typical phishing campaigns that rely on panic triggered by fake banking alerts, unpaid fines, or parcel delivery issues, Milk Dragon exploits consumer fear of missing out. According to Group-IB, operators post malicious links directly into ordinary Facebook and TikTok marketplace listings.
These posts feature heavy discounts on popular consumer goods, impersonating 21 distinct brands across fashion, cosmetics, food, baby products, and regional supermarkets. Documented targets include brands such as LEGO, Calvin Klein, and Aeon Malaysia. The lures rely on fake social media profiles, some utilizing AI-generated content and inflated follower counts to blend into social feeds.
Real-Time Keystroke Capture During Checkout
When shoppers click the promotional links, they are directed to WordPress sites running the legitimate WooCommerce e-commerce plugin. However, the storefronts also run a custom plugin named BytePress, which injects fraudulent credit card and PayPal checkout options.
BytePress maintains a persistent WebSocket connection to the attackers' command-and-control server. This setup captures payment details and personal data character by character as the user types, before the checkout form is even submitted. Through this live channel, operators can actively navigate the victim's browser session, trigger customized notifications, or validate card details in real time.
Automated 2FA Interception and Centralized Campaign Control
To authorize fraudulent transactions, the workflow displays a fake Turnstile loading screen while operators present a spoofed verification page designed to mirror 3D Secure authentication challenges. Once the victim submits a one-time password, attackers relay the code immediately to complete unauthorized charges or take over accounts.
Group-IB reported that the kit's centralized management dashboard allows multiple affiliates to manage campaigns, monitor visitor traffic, and store captured card records organized by issuing bank and card type. The examined infrastructure included templates mimicking 36 financial institutions, alongside automated alerts sent via Telegram bots. Group-IB advises consumers to avoid unverified third-party discount links and contact card issuers immediately if suspicious checkout activity occurs.
AI-generated editorial illustration; not a documentary photograph.
Source: Fake brand discounts on social media prey on shoppers’ fear of missing out
SIGNAL TITANS
Leave a Reply