Milk Dragon Moves Retail Phishing Into Marketplace Ads
Group-IB says the Milk Dragon phishing kit, also known as NaiLong, has been active since October 2025 and is tied to 258 fake pages across 66 countries. It uses social-media marketplace ads on Facebook and TikTok to push shoppers toward fake brand-discount stores.
The fake checkout page watches everything a victim types and sends it to the operator character by character before the form is submitted. That lets the scam steal card data and one-time passwords in real time, then relay the OTP to approve a fraudulent payment or account takeover.
For retail brands and marketplace teams, the choke point is no longer email filtering. The abuse sits in social ads and impersonation pages, so platform moderation and takedowns are where the campaign can be interrupted; if a brand sells through those channels, its name can be used as bait without ever touching inbox defenses.