Group-IB has warned that cybercriminals are using fake discount ads on Facebook and TikTok to drive shoppers to phishing sites that steal payment card details and one-time passwords. The Milk Dragon phishing kit, also known as NaiLong, has linked thousands of fake shopping pages across 66 countries by impersonating brands such as LEGO, Calvin Klein, and Aeon Malaysia. #GroupIB #MilkDragon #NaiLong #Facebook #TikTok #LEGO #CalvinKlein #AeonMalaysia
Keypoints
- Milk Dragon uses fake discount posts to lure shoppers into phishing traps.
- The kit has been active since October 2025 and spans victims in 66 countries.
- Fake storefronts impersonate 21 brands across multiple consumer categories.
- The checkout page captures card data and OTPs through a custom BytePress plugin.
- Operators use a panel and Telegram alerts to manage stolen data and monitor victims in real time.
Read More: https://www.helpnetsecurity.com/2026/10/05/milk-dragon-phishing-fake-discounts/