iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Yes. Milk Dragon, also called NaiLong, is a phishing operation that uses steeply discounted social-media shopping offers to draw people to counterfeit stores. Group-IB reported that its fake checkouts can capture payment details as they are entered and use a spoofed verification prompt to relay a one-time code into a live payment challenge. A fake order confirmation may then delay suspicion. If you entered payment or account information, contact the relevant institution using a known genuine channel and follow the steps at IdentityTheft.gov.
What is the Milk Dragon scam?
Group-IB identified Milk Dragon, also known as NaiLong, as an adversary-in-the-middle phishing kit active since at least October 2025. Its investigation, published October 1, 2026, describes fake retailer storefronts promoted through social-media posts or ads, including on Facebook and TikTok. The offers advertise large discounts on familiar products and lead shoppers to counterfeit websites. A recognizable logo or a post shown on a major platform does not establish that the linked store is genuine.
Group-IB reported identifying 258 phishing pages and victims in 66 countries. Those are findings from that investigation, not a verified count of every page or victim. It observed 21 impersonated consumer brands across cosmetics and fashion, food and beverage, home and baby products, and toys; LEGO, Calvin Klein, and Aeon Malaysia were cited as examples. Group-IB has not made the full brand list public.
Recommended Free Tools
How does Milk Dragon steal payment data?
1. A social-media deal directs shoppers to a fake store
The lure is an unusually attractive offer for a familiar product. Group-IB said some profiles promoting the offers appeared potentially fake and some contained AI-generated content, but it could not establish who operated those profiles.
#1 Best Overall
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
2. The fake checkout captures information as it is typed
The investigated storefronts used WordPress, the legitimate WooCommerce plugin, and a custom plugin called BytePress. Group-IB says BytePress maintains a WebSocket connection to the operator panel and streams checkout inputs character by character, before the shopper submits the form. Operators can also direct the shopper through pages and notifications. A familiar checkout design therefore does not prove that the page is safe.
3. A spoofed verification prompt may relay a live code
After payment information is entered, the site may show a fake loading screen and then a verification prompt designed to resemble a live 3-D Secure challenge. If the shopper enters the one-time code, an operator can relay it in an attempt to authorize a fraudulent transaction or take over an account. Group-IB also reports that a fake order confirmation may make the purchase appear complete and delay the shopper’s response.
Rank #2
- Protect accounts with USB-C & NFC 2FA security key. Hardware-based authentication blocks phishing, credential theft & unauthorized access across cloud, enterprise & personal platforms.
- FIDO2 Level 2 certified Security Key. Works with Apple ID, Microsoft Azure/Entra ID, AWS, Google, Facebook, Salesforce, DUO & more. Compatible with Chrome, Safari & Edge on all major OS.
- Plug & play USB-C Security Key with NFC tap login. No software, drivers or batteries required. Works with Windows PC, MacBook, iPhone, Android & Chromebook for fast, secure authentication.
- Built with FIPS 140-2 Level 3 secure element for advanced encryption. Trusted by IT teams, healthcare, education & government for secure authentication & identity protection.
- IP68 waterproof, dustproof & crush-resistant design. Supports FIDO2, U2F, OTP, PIV, Mini Driver & smart card login. Durable USB security key for long-term enterprise & daily use.
Group-IB observed 36 distinct financial-institution templates. That means templates impersonating financial institutions were found; it does not mean those institutions were hacked.
How to check whether a social-media deal is legitimate
- Go to the retailer independently. Open its known official website or app yourself instead of using the post’s link. Check the domain carefully before entering payment details.
- Check whether the offer appears on the official route. Look for the same deal on the retailer’s independently reached site or app, rather than trusting a social post, logo, or polished storefront.
- Pause at implausibly large discounts. A steep discount is a reason to verify the seller, not proof by itself that an offer is fraudulent.
- Treat verification prompts cautiously. A one-time code request does not prove a store is legitimate. Do not enter a code into a page reached from an unverified shopping link.
- Optionally check an unfamiliar URL. Group-IB recommends tools such as urlscan.io, VirusTotal, or ScamAdviser. Such checks are supplementary; they do not replace confirming the seller through an official route you chose independently.
What to do if you entered payment or account information
- Contact the card issuer or financial institution promptly. Use the number printed on your card or another official contact channel you already know is genuine—not details supplied on the suspicious page or message.
- Follow the institution’s instructions. Ask what to do about the card or account, including whether it should be frozen or replaced, and review recent transactions for activity you do not recognize.
- Use IdentityTheft.gov if financial or personal information was exposed. The FTC directs people who think a scammer has their credit-card or bank-account information to IdentityTheft.gov for tailored recovery steps.
- Report the phishing attempt to the FTC where applicable. Use the FTC’s official fraud-reporting route, and do not rely on contact information provided by the suspicious site.
What Group-IB’s findings do—and do not—show
The reported counts describe what Group-IB observed in its 2026 investigation. They do not establish the campaign’s total losses, success rate, full set of affected brands or institutions, or whether a particular shopper or merchant was affected. Nor does an impersonated brand or financial institution necessarily indicate that the organization itself was compromised. Group-IB says its complete brand list and indicators of compromise are available only to its intelligence customers.
Rank #3
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T120. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T120 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-C port : Insert the T120 security key into the USB-C port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Group-IB also reported that the kit was offered through Telegram communities as a subscription service starting at 300 USDT per month. That is a reported offer in the investigation, not a verified current price quote.
Quick Recap
Rank #4
- 【Identity Theft Guard】Roller stamp blocks sensitive data on mail with thick ink ensuring complete privacy coverage for addresses and account numbers instantly
- 【Shredder Alternative】Quick dry ink conceals info in seconds allowing paper recycling without shredding saving time while maintaining document security effectively
- 【Ready To Use】Pre inked ABS body provides up to 100 meters of coverage right out of box offering durable long lasting performance without immediate refills
- 【Versatile Application】Address blocker works on envelopes invoices packages labels and documents providing comprehensive privacy protection for home office travel
- 【Compact Portable Design】Lightweight ergonomic roller fits easily in desk drawers or travel bags allowing comfortable grip and instant info concealment anywhere
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
