Milk Dragon Phishing Kit Uses Facebook and TikTok Discounts to Steal Cards and Bypass MFA

Gbhackers •Mayura Kathir • October 2, 2026

A phishing-as-a-service operation dubbed Milk Dragon, also known as NaiLong, is abusing discount-themed and TikTok posts to steal payment-card data and intercept multi-factor authentication (MFA) challenges. Group-IB identified 258 phishing pages linked to the kit since October 2025, with victims across 66 countries. Rather than relying on classic delivery-failure notices, bank alerts, or account-lockout […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Milk Dragon Phishing Kit Targets Social Media Discounts to Steal Payment Data The Milk Dragon phishing kit, also known as NaiLong, is a phishing-as-a-service operation exploiting social media platforms like Facebook and TikTok to lure victims with fake discounts. Group-IB identified 258 phishing pages linked to this kit since October 2025, affecting victims across 66 countries. The kit utilizes Adversary-in-the-Middle (AiTM) techniques to bypass multi-factor authentication (MFA) protections, employing 36 distinct banking templates. Threat actors promote heavily discounted products through native social media posts, driving traffic to fraudulent websites. The Milk Dragon kit has been actively sold on Telegram, with ongoing support provided to affiliates. Major brands, including LEGO and Calvin Klein, have been impersonated to deceive users. The operation has raised significant concerns among cybersecurity analysts and law enforcement agencies. 2 sources 68

Extracted Entities

Milk Dragon Phishing Kit Uses Facebook and TikTok Discounts to Steal Cards and Bypass MFA

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

MITRE ATT&CK (1)

Platforms (2)