Phishing
Milk Dragon: fake social media discounts steal cards and OTPs
Group-IB tracked the Milk Dragon phishing kit to 258 fake shops and victims in 66 countries. How its live checkout works and what brands and banks can do.
Group-IB has published research on Milk Dragon, a phishing kit also tracked as NaiLong, that sells fake discounts on Facebook and TikTok and turns the checkout into a live card fraud session. Since October 2025 the researchers have identified 258 phishing pages built with it and victims in 66 countries. The shops impersonate 21 brands in cosmetics and fashion, food and drink, home and baby products, toys and regional supermarkets, with LEGO, Calvin Klein and Aeon Malaysia among the names used.
This matters for three groups. Retailers whose brands appear in the ads take the complaints and the reputational damage. Card issuers see the fraud, often approved with a valid one-time password (OTP). And employers see staff who shop on work devices or pay with corporate cards. The kit is sold as a subscription on Telegram from 300 USDT (a dollar-pegged stablecoin) a month, so the operators who run campaigns are customers, and the number of campaigns depends on how many people buy it.
How it works
Most phishing works on fear: a parcel fee, a traffic fine, a locked bank account. Milk Dragon runs on the fear of missing out. Ads and native posts on Facebook and TikTok marketplaces offer steep, time-limited discounts on familiar brands. Group-IB says some come from fake profiles with AI-generated content that may have bought followers, and it is not clear whether the operators run those accounts or rent them from an underground distribution service.
The link leads to a WordPress site posing as a discount retailer. The shop runs WooCommerce, the standard and unmodified e-commerce plugin, so the product pages, cart and checkout look and behave like thousands of legitimate small shops. The malicious part is a custom plugin called BytePress. It adds a fake credit card payment option and a fake PayPal option to the checkout, and its settings page has an "API Base URL" field that points the shop at the operator's command-and-control (C2) panel.
BytePress keeps a persistent WebSocket connection (a two-way channel that stays open, here built on the socket.io library) between the victim's browser and the panel. Every keystroke in the payment form streams to the operator character by character, before the victim presses submit. A victim who types a card number and then changes their mind has already lost it. Over the same channel the operator can redirect the victim to another page, accept, reject or block the payment attempt, and push custom notifications into the page.
The OTP step is where the money moves. After the card is entered, the victim sees a fake Cloudflare Turnstile loading page, the "checking your browser" screen many real sites show. While it spins, the operator uses the card details to start a real transaction somewhere else, sees which verification the issuing bank asks for, and picks a matching page from the kit. Group-IB found templates for 36 financial institutions that mirror the 3D Secure (3DS) challenge, the bank check that sends an OTP or an app prompt to approve an online card payment. The victim enters the OTP believing it confirms their discount order, and the operator relays it to approve the fraudulent transaction or take over the account.
The last page is a fake order confirmation. The victim expects a parcel, so they have no reason to call their bank for days, which gives the operator time to use the card again.
What the operators get
The subscription pays for the panel. Buyers supply a server IP address or domain plus SSH credentials, and an installer deploys the panel as a Docker container with its database and API services. It stores card details, OTPs, personal information, device metadata and order details for every victim, so an affiliate can return to old records and target the same people again. Cards are tagged automatically by type and issuing bank from the BIN (the first digits of the card number, which identify the issuer), which tells the operator which 3DS template to show.
Operators get alerts in the browser or through a Telegram bot, a live view of each session and a dashboard of visitors, orders and completed payments per site. Role-based accounts let several affiliates run campaigns through one C2 server, and plugin updates are pushed from the panel to every shop. A builder for custom OTP and app-verification pages lets affiliates match the bank templates to the country they target.
Group-IB has not published indicators of compromise. It says they are available to its customers only, so defenders have to work from the behaviour described above.
What to do
Retailers and brand owners. Watch for your brand in places you do not control. Register alerts for lookalike domains that contain your brand name with words like sale, outlet or discount, and search the Meta Ad Library and TikTok's Commercial Content Library for ads using your name and product photos that do not come from your accounts. Report fake shops to the hosting provider, the registrar and the platform as soon as you find them; Group-IB's advice is to start takedowns before a campaign scales. Put a short notice on your site and social profiles saying where your genuine sales run, so support staff can point customers to it.
Card issuers and payment teams. Milk Dragon defeats OTPs by relay, so the OTP alone proves little. Name the merchant and amount in every 3DS SMS or app prompt, so a victim paying a cosmetics shop sees a different merchant asking for approval. Score as high risk a card used at a new merchant within minutes of its details being entered, especially when the device or country differs from the cardholder's usual pattern. When a customer reports a fake shop order, block and reissue the card instead of only disputing the charge: the panel keeps the details for reuse.
Anyone who hosts WordPress shops. If you run a hosting or agency platform, a WooCommerce site with a plugin named BytePress, or with checkout pages that open a socket.io connection to a host outside the shop's own domain, warrants a look. On sites you manage, list installed plugins with wp plugin list and compare them with what the site owner expects.
Employers. Give staff one rule: if a social media ad offers a big discount on a well-known brand, go to the brand's own site by typing its address. If someone has already paid, they call the number on the back of the card and ask for it to be blocked and reissued, then check statements for small test charges in the following weeks. For corporate cards, the card programme administrator should do the same and review recent transactions on that card.
Why fake shops keep working
The trust signals people are taught to check do not help here. The page is served over HTTPS, the checkout is real WooCommerce, the verification screen looks like the bank's own, and the OTP arrives from the real bank because the real bank is approving a real transaction. The checks that still work are outside the page: whether the merchant name in the OTP message matches the shop, and whether the shop's domain belongs to the brand.
If you want to know where your brand is being impersonated, or how your checkout and customer accounts hold up against relay phishing, our web penetration testing and security operations teams can help. Open the chat and Yaali, our AI agent, will pass your question to an engineer.
Sources: Group-IB, Help Net Security, TechJuice