Milk Dragon Phishing Kit Exploits Social Media Discounts to Steal Payment Data and Bypass MFA A phishing-as-a-service (PhaaS) operation called Milk Dragon (also known as NaiLong) is targeting victims across 66 countries by abusing Facebook and TikTok ads to steal payment-card data and intercept multi-factor authentication (MFA) challenges. Since October 2025, cybersecurity firm Group-IB has identified 258 phishing pages linked to the kit, which impersonates 21 brands, including LEGO, Calvin Klein, and Aeon Malaysia. Unlike traditional phishing campaigns that rely on fake bank alerts or delivery failures, Milk Dragon exploits social-commerce behavior by luring victims with heavily discounted consumer goods from recognizable brands. The threat actors use fake profiles with AI-generated content and inflated follower counts to appear legitimate, weaponizing the fear of missing out (FOMO) to lower suspicion. Once a victim clicks on an ad, they are redirected to a WordPress-based phishing site designed to mimic a legitimate e-commerce store. The attackers leverage WooCommerce, a legitimate WordPress plugin, to create convincing product pages, shopping carts, and checkout workflows. A malicious WordPress plugin called BytePress is then injected to hijack payment forms, replacing them with fraudulent credit-card and PayPal fields. The phishing kit uses persistent WebSocket communications to stream victim-entered data character by character to the attackers’ command-and-control (C2) infrastructure. After capturing card details, the site displays a fake loading screen while the attacker selects the appropriate 3-D Secure authentication challenge. The victim is then prompted to enter a one-time password (OTP) or app verification code, which the attacker relays in real time to authorize fraudulent transactions. To delay detection, Milk Dragon redirects victims to a counterfeit order-confirmation page after harvesting their data. The kit has been sold on Telegram since at least October 2025, with subscriptions starting at $300 USDT per month. Buyers gain access to a centralized operator panel with features like role-based accounts, live victim monitoring, Telegram alerts, and centralized storage of stolen data. The operation highlights the evolution of phishing beyond traditional email and SMS attacks, demonstrating how social media and e-commerce platforms are now prime targets for adversary-in-the-middle (AiTM) fraud. The use of WebSocket-based exfiltration and real-time MFA interception underscores the growing sophistication of payment fraud schemes.