Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Milk Dragon, also known as NaiLong, is an adversary-in-the-middle (AiTM) phishing kit that uses fake bargain storefronts to steal payment details and relay one-time passcodes into real payment-authentication flows. Group-IB reported that the campaign has been active since October 2025. Its October 1, 2026 report describes 258 phishing pages, victims in 66 countries, and 36 financial-institution verification templates observed by the researchers—not a complete count of all activity.
What Milk Dragon does
Milk Dragon is a phishing-as-a-service kit reportedly sold through Telegram communities. It targets shoppers rather than relying only on familiar lures such as account-warning or delivery-failure messages. A typical approach is to advertise an unusually cheap consumer product through Facebook or TikTok marketplace ads or native posts, then send interested buyers to a counterfeit shop.
The kit is designed to collect card or other payment details and exploit the shopper’s interaction with a genuine authentication challenge. This is AiTM phishing: the criminal operator sits between the victim and a real service, relaying information between them. The reported attack abuses the authentication flow; Group-IB does not describe a flaw in the 3D Secure protocol itself.
How the scam moves from an ad to a stolen code
1. A steep discount leads to a fake shop
The shopper follows a social-media promotion to a storefront that imitates a legitimate retailer. Group-IB says the pages use WordPress and WooCommerce, with a custom plugin called BytePress. The checkout can present fake card and PayPal payment options while connecting the page to the operators’ panel.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
2. BytePress streams checkout input to an operator
Group-IB reports that BytePress maintains a persistent Socket.IO WebSocket connection to the operator panel. As the shopper types into checkout fields, the kit can stream the input character by character before the form is submitted. This is sometimes described as WebSocket keylogging, but the reported behavior concerns input on the compromised checkout page—not proof that the kit records every keystroke across the shopper’s device.
The live connection also lets an operator alter the checkout flow or display notices while the victim is using the page. That makes the interaction more adaptable than a static form that simply collects and sends submitted data.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
3. A counterfeit verification page captures a one-time code
After payment details are entered, the victim may see a loading screen followed by a fake bank-verification or one-time-passcode page. The operator can use the submitted details to initiate a real 3D Secure (3DS) or other authentication flow, then relay the code the shopper enters into the counterfeit page. If the real challenge is approved, a fraudulent transaction may be authorized; the captured information may also support account takeover, depending on the flow involved.
4. A fake confirmation can delay suspicion
The shopper may be shown a counterfeit order confirmation after entering the code. That can make the interaction look complete while the victim believes a purchase has gone through.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
What Group-IB reported—and what the figures mean
| Reported observation | Qualification |
|---|---|
| 258 phishing pages | Identified by Group-IB since the campaign’s reported start in October 2025; reported October 1, 2026. |
| Victims in 66 countries | Geographic reach observed by Group-IB, not a complete global victim count. |
| 36 financial-institution verification templates | Templates reported in Group-IB’s October 1, 2026 investigation. |
| From 300 USDT per month | Group-IB’s reported observation of the kit’s criminal-market subscription price; this is not a legitimate service or a recommendation to buy it. |
These are figures from one company’s investigation, not an exhaustive census of every Milk Dragon page, victim, or operator. Group-IB also reported ongoing developer support and updates for affiliates and operators.
How shoppers can reduce risk
- Treat extreme discounts as a reason to verify. A social-media ad, marketplace post, polished page, or low price does not establish that a seller is genuine.
- Check the destination before entering payment details. Look closely at the domain and independently navigate to the retailer’s known website rather than trusting an ad link. Link-reputation services such as urlscan.io, VirusTotal, and ScamAdviser can provide additional context, but a clean or inconclusive result should not be treated as proof that a shop is safe.
- Be cautious when checkout changes unexpectedly. A loading screen followed by a bank-branded code page is not, by itself, proof of fraud, but an unfamiliar shop or suspicious domain makes the request riskier. Do not enter a code on a page reached through a questionable seller link.
- Act quickly if you submitted information. Contact your bank or card issuer immediately if you entered card details or an authentication code on a suspicious page. Ask what steps are appropriate for the account or card, and review recent activity for transactions you do not recognize.
What organizations should monitor
For retailers, financial institutions, and security teams, the described attack spans social-media lures, lookalike storefronts, live checkout capture, and payment authentication. Monitoring can therefore focus on the points where the flow becomes visible:
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Lookalike domains and counterfeit storefronts that imitate the organization or its partners.
- Unusual checkout behavior and suspicious card activity that may follow a phishing campaign.
- Emerging phishing-kit activity, including operator-driven changes to checkout or verification pages.
Group-IB says its full indicator-of-compromise data is restricted to its customers, so its public report does not provide a complete IOC list for defenders to reproduce.
Quick Recap
Best Value
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
