iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Milk Dragon uses steep-discount offers on Facebook and TikTok to lure shoppers to counterfeit stores, where it can capture card details and relay a one-time verification code into a live payment challenge. Group-IB reported the kit active since October 2025; its findings describe a way to exploit a transaction’s verification step, not a method that defeats every form of multi-factor authentication or guarantees a successful fraud.
How the Milk Dragon scam works
Group-IB, in an investigation published October 1, 2026, calls Milk Dragon—also known as NaiLong—an adversary-in-the-middle (AiTM) phishing kit. Rather than relying only on a fake bank warning or delivery notice, operators use social-commerce offers: a post or ad promises a steep discount on a familiar brand and sends shoppers to a counterfeit storefront.
- The offer attracts a shopper. A post or marketplace-style ad on Facebook or TikTok presents a deal that appears to come from a known retailer.
- The link opens a fake shop. Group-IB says the counterfeit storefronts run on WordPress and use WooCommerce to display products and checkout pages. Named impersonation examples include LEGO, Calvin Klein and Aeon Malaysia.
- The checkout captures payment details. A custom malicious plugin called BytePress adds fraudulent credit-card and PayPal checkout options and connects the page to an operator control panel. Group-IB reports that a persistent Socket.IO WebSocket sends information entered into the payment page to that panel character by character, before the shopper submits the form.
- A fake loading screen leads to a verification prompt. After payment details are entered, the shopper may see a loading or “turnstile” screen. The operator can select a verification page matching the legitimate payment’s 3-D Secure challenge and show a spoofed one-time-password or app-verification prompt.
- The operator relays the code into the live challenge. If the shopper supplies the code, the operator can enter it into the real payment challenge and attempt to authorize a fraudulent transaction. A counterfeit order confirmation may then postpone suspicion.
That relay is what makes the attack adversary-in-the-middle: the victim interacts with a convincing page while an operator passes information between the victim and a real transaction. It can expose a one-time code to misuse during that transaction, but the reporting does not establish that every attempt succeeds or that the kit defeats all authentication methods.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What Group-IB observed—and what the counts mean
Group-IB’s October 1, 2026 investigation reported 258 phishing pages identified since October 2025, victims spanning 66 countries, 21 consumer brands observed as impersonation targets, and 36 financial-institution verification templates. These are the investigation’s observed figures, not a complete count of every page, victim, impersonated brand or affected institution.
#1 Best Overall
- STYLISHLY SMALL, SLIM & DISCREET: Measuring just 3 1/8" x 4 7/16", our RFID front pocket wallet is designed to be super thin and exceptionally slim. Its modern, minimalist profile fits perfectly in your pocket, purse, or travel pack without adding bulk.
- SURPRISINGLY SPACIOUS: Though slim, it features 8 slots to easily organize your essentials. Comfortably holds your driver's license, credit cards, debit cards, and membership cards, keeping everything you need right at your fingertips.
- ADVANCED RFID BLOCKING: Our slim wallets for men and women are outfitted with advanced RFID SECURE Technology. They block electronic signals to keep your identity protected while you travel, shop, or explore, safeguarding you from digital theft.
- DURABLE & STYLISH FAUX LEATHER: Crafted from premium synthetic leather, this minimalist wallet sleeve combines a luxurious look and feel with everyday functionality. Its durable construction is designed to withstand the rigors of daily use, travel, and shopping.
- THE PERFECT UNISEX GIFT: With its sleek design and practical security features, this wallet is a popular choice for both men and women. It arrives ready for gifting, making it an ideal present for the frequent traveler, minimalist, or anyone in your life!
The report describes targets across cosmetics and fashion, food and beverage, home and baby products, toys, and regional supermarket chains. Group-IB says the full brand list is restricted to customers of its intelligence portal. It does not publish a complete indicator-of-compromise list, identify affected banks, establish total losses or victims, or report a confirmed success rate for fraudulent transactions.
Why a social-media ad is not proof that a shop is genuine
A familiar logo, a polished storefront and an ad shown inside a major social platform do not independently verify the seller. The ad is the lure; the destination checkout is where payment details and verification codes may be exposed. A particularly steep discount should prompt an independent check before entering any information.
Rank #2
- Slim and Thin Wallet - This minimalist bifold wallet measures 4.3x3.2x0.6 inches and stores up to 15 cards. The bifold wallet perfectly fits in your pocket and is well-suited for everyday carry
- Elite Features - 2 ID windows (DL & Other ID Cards) and 2 quick slots allow for quick access during travel, shopping or work. With 15 card slots and 2 more slots behind them, it is easy to carry all your important cards,cash and bills, meet all your daily needs
- RFID Blocking- Our wallets are equipped with advanced RFID SECURE Technology, a unique metal composite, engineered specifically to block 13.56 MHz or higher RFID signals and protect the valuable information stored on RFID chips from unauthorized scans.License and ID cards will be protected effectively. No more worrying about unauthorized scans during travel, shopping, or daily commuting!
- Durable Surface - Our leather wallets are pressed with high quality 3 layers leather, which is more durable than 2 layers leather wallets. The surface of the leather is made more scratch-resistant by special treatment, which can effectively prevent small scratches caused by keys and buttons in life
- Gifts for him - The thin wallet comes in classy gift packaging. It is a perfect present for birthdays, anniversaries, Father's Day, Valentine's Day, Christmas and other special occasions, so you can easily gift it to someone you love
Check the offer through a route you choose
- Open the retailer’s official app or type its known website address yourself instead of following the ad’s embedded link.
- Check that the seller and domain match the retailer’s official presence; a brand name or logo on a page is not enough.
- For an unfamiliar link, reputation services such as urlscan.io, VirusTotal or ScamAdviser can provide an additional check. A clean or inconclusive result does not prove a shop is legitimate.
- Be wary if the path from an ad quickly asks for card details and a one-time code before you can verify the seller independently.
What to do if you entered payment details or a code
- Contact your bank or card issuer immediately. Explain that you entered details on a suspected counterfeit checkout and, if applicable, supplied a 3-D Secure code or app approval. Ask whether to block or replace the card and what action to take on any pending transaction.
- Review recent and pending transactions. Report unfamiliar activity to the issuer promptly and follow its instructions for disputes or account protection.
- Change reused credentials. If you created an account or reused a password on the suspicious site, change that password through the legitimate service’s app or website, not through a link from the ad. Change it anywhere else you reused it.
- Stop interacting with the page. Do not provide more codes, approve further prompts, or return to the site using its links.
For retailers and security teams, Group-IB recommends monitoring lookalike domains and suspicious checkout or card activity, and taking action against infrastructure abusing a brand. Its report also recommends threat-intelligence solutions for enterprise detection; it does not establish the effectiveness of a particular product.
Recommended Free Tools
How the kit is operated
Group-IB says Milk Dragon was offered as phishing-as-a-service in Telegram communities from at least October 2025, with subscription access to phishing panels and a reported starting price of 300 USDT per month. That is a detail from the investigation, not confirmation that the service is currently available at that price.
Rank #3
- Ultra-thin: This wallet measures 4.3 x 3 x 0.5 inches and can hold at least 11 cards and 15-20 bills. Even when it's packed full, it's only 0.8 inches thick,It can perfectly conceal itself in your pocket without any noticeable bulge.
- Rfid Blocking: Our wallets are equipped with German Instiute Certified RFID Security technology, a unique metal composite, engineered specifically to block 13.56 MHz or higher RFID signals to protect the valuable information and privac.
- Lifetime After-sales Service: Regardless of the circumstances, if any GSOIAX brand wallet has a quality issue during your use, we promise to provide a full, unconditional, refund within 24 hours!
- Durable Surface: Crafted from premium 3-layer leather, our wallets outperform 2-layer alternatives in durability. Specially treated leather exterior delivers enhanced scratch resistance to guard against minor scuffs from everyday items like keys and buttons.
- Perfect Gifts For Him: This Money Clips Wallets for men comes in classy gift box package. It's a good idea to send the mens wallets as the gifts in birthday，anniversaries, Fathers Day，Valentine's Day，Christmas and other special occasions to someone you love.
The investigated panel included role-based accounts, live control of phishing pages, operator notifications, card BIN tagging, and centralized storage of visitor and payment information. Group-IB also describes containerized panel installation. Those capabilities indicate a managed operation model, but do not establish how many criminal customers used the kit or how many victims any operator reached.
Quick Recap
Best Value
- ★REAL LEATHER: This wallet is MADE IN INDIA and comes in 2 leather qualities, namely Nappa and Crazy Horse. Nappa leather is conventional drum dyed leather which is finished with natural pigments to attain a smooth and buttery touch, while Crazy Horse is vegetable tanned and sprayed with oils and waxes to give a distressed look with warm and soft touch.
- ★ELITE FEATURES: ID windows allow for quick access when traveling or at the store /working place. With 5 card slots and 2 more slots behind them, it’s easy to carry all your important cards, meet all your daily needs.
- ★RFID BLOCKING ANTI THEFT SECURITY: Our wallets are anti theft, equipped with advanced RFID SECURE Technology, a unique metal composite, engineered specifically to block 13.56 MHz or higher RFID signals and protect the valuable information stored on RFID chips from unauthorised scans and make them anti theft.
- ★COMPACT DESIGN: Making this bifold superb for travel, and everyday use, keeping cards safe and organized! It holds 8+ cards, and lots of cash!
- ★GIFT BOX PACKING: It is one of the most special gifts for Groomsmen, Birthdays, Anniversaries, Father's Day, Christmas and other Special Occasions.
Rank #4
- 【RFID Blocking Wallet for Men】Protect your personal information with our advanced RFID blocking tech. The wallet features a durable metal shell and composite materials that block 13.56 MHz and higher RFID signals, keeping your credit cards and IDs safe from electronic theft no matter where you are
- 【Card Slides Out Smoothly】This minimalist wallet features a button-activated ejection mechanism that pops cards up for easy access. The inner-facing slot ensures cards stay secure and never fall out
- 【Minimalist, Perfectly Slim】Designed to be sleek and easy to carry, featuring a dedicated ID card slot that allows for swiping without removing the card. It's perfect for ID cards, work badges, access cards, and transit cards. A separate cash compartment keeps your bills organized
- 【12 Card Slots & Cash Slot】Offers a total capacity of 12 cards (6 cards fitting in the chamber, 1 ID card, 4 slots on the wallet's outer surface, 1 slot on the card case exterior) and a cash slot. It features premium leather and aluminum chamber with a smooth pop-up card function, secured by a magnetic cover
- 【Premium Craftsmanship】Discover the perfect blend of quality and functionality with our wallet. Crafted from premium leather and airplane-grade aluminum, it features a convenient side pop-up for easy access. Durable and stylish, it complements both business and casual settings
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
