Skip to content
Milk Dragon Phishing Kit Targets Social Media Discounts to Steal Payment Data

Milk Dragon Phishing Kit Targets Social Media Discounts to Steal Payment Data

First seen 2 Oct 2026, 12:13 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 2, 2026 at 13:09 UTC
  • •Milk Dragon phishing kit exploits social media discounts to steal payment data.
  • •The operation has affected victims in 66 countries with 258 phishing pages identified.
  • •Threat actors use AiTM techniques to bypass MFA protections.

The Milk Dragon phishing kit, also known as NaiLong, is a phishing-as-a-service operation exploiting social media platforms like Facebook and TikTok to lure victims with fake discounts. Group-IB identified 258 phishing pages linked to this kit since October 2025, affecting victims across 66 countries. The kit utilizes Adversary-in-the-Middle (AiTM) techniques to bypass multi-factor authentication (MFA) protections, employing 36 distinct banking templates. Threat actors promote heavily discounted products through native social media posts, driving traffic to fraudulent websites. The Milk Dragon kit has been actively sold on Telegram, with ongoing support provided to affiliates. Major brands, including LEGO and Calvin Klein, have been impersonated to deceive users. The operation has raised significant concerns among cybersecurity analysts and law enforcement agencies.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2025-10-01
Milk Dragon phishing kit identified
Group-IB reported the Milk Dragon kit's activities, including 258 phishing pages and victims in 66 countries.
Group-IB
2026-10-01
Milk Dragon phishing kit details published
Group-IB published a blog detailing the phishing kit's operation and its use of social media for attacks.
Group-IB
2026-10-02
Gbhackers report on Milk Dragon
Gbhackers published an article summarizing the Milk Dragon phishing kit's methods and impact.
Gbhackers

More articles in this cluster (2)

Following this threat?

Track Aeon Malaysia in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (19)

1 / 3

Common questions

How does the Milk Dragon kit operate?
The Milk Dragon kit uses social media posts to lure victims with fake discounts, leading them to phishing sites.
What brands are being impersonated?
The kit has impersonated well-known brands like LEGO, Calvin Klein, and various financial institutions.
What can organizations do to protect against this threat?
Organizations should educate users about phishing tactics and implement robust MFA solutions to mitigate risks.