Group-IB exposes Milk Dragon phishing kit using fake social media discounts

Group-IB has warned about the Milk Dragon (NaiLong) phishing kit, which since October 2025 has used fake brand discounts on Facebook and TikTok to steal card details and one-time passwords. Researchers linked it to 258 phishing pages and victims in 66 countries, with LEGO, Calvin Klein and Aeon Malaysia among the baits.

• Active since October 2025: 258 phishing pages and victims in 66 countries
• Fake shops impersonate 21 brands, including LEGO, Calvin Klein and Aeon Malaysia
• Operator panel captures card input keystroke by keystroke via WebSocket before submission
• Panels held templates impersonating 36 financial institutions for fake 3DS checks