A phishing-as-a-service kit called Milk Dragon has targeted shoppers across 66 countries by posting fake discount deals on Facebook and TikTok marketplaces. Security firm Group-IB published the findings on October 1, 2026, after tracking 258 phishing pages linked to the operation since October 2025.
The kit, also tracked as NaiLong, takes a different approach from traditional phishing campaigns. Instead of sending urgent warning emails, operators post social media advertisements that promote steep discounts on everyday goods. These ads cover cosmetics, fashion, electronics, toys, and supermarket products from 21 impersonated brands. The marketplace listings blend into organic social media content, which lowers user suspicion compared to standard email-based attacks.
Victims who click these ads land on WordPress sites running WooCommerce checkout pages designed to mimic legitimate retailers. A custom malicious plugin called BytePress then establishes a persistent WebSocket connection between the victim’s browser and the operator’s command server. This connection streams every keystroke in real time, character by character, before the victim even submits the form.
| Feature | Classic Man-in-the-Middle (MitM) | Adversary-in-the-Middle (AiTM) |
| Primary Target | Network Traffic (e.g., Unsecured Wi-Fi) | Authentication Session (Identity) |
| Attack Method | Eavesdropping, ARP Spoofing | Reverse Proxy Relay, Phishing |
| MFA Impact | Often stopped by standard MFA | Designed specifically to bypass MFA |
| Defense | HTTPS Encryption (TLS) | FIDO2 / Hardware Keys |
After the checkout page captures payment card details, BytePress redirects victims to a fake 3D Secure verification page. The operators built 36 distinct bank verification templates for this step. They relay captured one-time passwords to authorize fraudulent transactions or take over accounts. A fake order confirmation page then appears, which delays fraud detection by making victims believe the purchase succeeded.
Group-IB researchers Brandon Tan, Tsai Shun Ling, and Viacheslav Shevchenko found that Milk Dragon sells as a subscription service on Telegram for 300 USDT per month. The kit includes multi-account management with role-based access, automated Telegram notifications, credit card BIN identification, and live session monitoring. This model lowers the technical barrier for less-skilled threat actors to run convincing fraud campaigns across multiple phishing sites from a single panel.
