Milk Dragon phishing campaign uses fake discount posts to steal data

Security researchers at Group-IB say a campaign called Milk Dragon uses social media posts promoting steep discounts to direct shoppers to fake ecommerce sites. The posts have appeared mainly in Facebook and TikTok groups where users look for bargains.

Group-IB says the operators have used a phishing kit also called Milk Dragon for at least a year. It creates spoofed versions of popular shopping sites and can use AI to generate fake product listings. The sites contain BytePress malware, which captures information people type into forms, even before they submit it. When shoppers do submit details, the campaign can relay them through attacker infrastructure to legitimate sites and capture returned requests for one-time passwords and other multi-factor authentication.

The researchers say victims may then see a fake order confirmation, making the purchase appear successful. Group-IB found victims in 66 countries. Its report identified the largest numbers in Malaysia (1,300+), Singapore (1,200+) and Thailand (1,100+). The campaign spoofed 21 brands and also impersonated 36 financial institutions and banks.

The phishing kit is sold through Telegram channels as a service, with monthly or yearly plans. Group-IB says prices start at 300 USDT per month, with different plans and add-ons available.