Threats · 15h ago
Group-IB says the Milk Dragon phishing kit, also known as NaiLong, has been active since October 2025 and is tied to 258 fake pages across 66 countries. It uses social-media marketplace ads on Facebook and TikTok to push shoppers toward fake brand-discount stores.
The fake checkout page watches everything a victim types and sends it to the operator character by character before the form is submitted. That lets the scam steal card data and one-time passwords in real time, then relay the OTP to approve a fraudulent payment or account takeover.
For retail brands and marketplace teams, the choke point is no longer email filtering. The abuse sits in social ads and impersonation pages, so platform moderation and takedowns are where the campaign can be interrupted; if a brand sells through those channels, its name can be used as bait without ever touching inbox defenses.
1 source covering this story
Fake brand discounts on social media prey on shoppers' fear of missing out - Help Net Security
Cybercriminals use fake discounts on Facebook and TikTok to lure shoppers to phishing sites that steal payment card details and OTPs.
Part of the PlainSec briefing for 2026-10-06