Security researchers have identified Milk Dragon (also known as NaiLong), a Phishing-as-a-Service (PhaaS) platform being used in large-scale social media fraud campaigns. By impersonating well-known brands and using realistic online shopping experiences, the threat enables attackers to steal payment card information, personal data, and one-time passcodes used for transaction verification.
What is the threat?
Milk Dragon, also known as NaiLong, is a Phishing-as-a-Service (PhaaS) kit used in large-scale payment fraud campaigns on social media platforms such as Facebook and TikTok. Attackers use fake ads and marketplace listings that impersonate trusted brands and promote heavily discounted products to lure victims to fraudulent online stores.
These websites mimic legitimate e-commerce experiences to collect payment card information, personal data, and contact details. The kit’s most dangerous feature is its Adversary-in-the-Middle (AiTM) capability, which allows attackers to intercept and relay one-time passcodes (OTPs), 3D Secure challenges, and other payment verification requests in real time to facilitate fraudulent transactions.
Milk Dragon relies on a malicious WordPress plugin called BytePress, which connects phishing sites to an attacker-controlled management panel. This enables operators to monitor victim activity, capture submitted data, and manage multiple campaigns simultaneously. To avoid suspicion and buy time for fraud, phishing sites may display fake payment errors, verification prompts, or order confirmation screens.
Why is it noteworthy?
Milk Dragon highlights the evolution of phishing from simple credential-harvesting pages to sophisticated phishing-as-a-service platforms that combine social engineering, payment fraud, and real-time MFA interception.
The campaign is also notable because it primarily spreads through social media advertising and online marketplaces rather than email, allowing it to bypass many traditional phishing detection controls. Its use of realistic e-commerce storefronts, trusted brand impersonation, and real-time verification theft makes the scams particularly convincing and scalable.
What is the exposure or risk?
Milk Dragon primarily targets consumers, but it also creates risks for businesses. Organizations may face brand impersonation, customer fraud, reputational damage, increased support costs, and loss of customer trust when their products or branding are abused in fake advertisements and storefronts.
Businesses may also be affected if employees use corporate payment cards or company email addresses on fraudulent sites, potentially exposing payment information and personal data. Financial institutions and payment processors face additional risk because the kit can facilitate theft of OTPs and 3D Secure verification codes used to validate transactions.
What are the recommendations?
Barracuda strongly recommends the following actions to reduce the risk of exploitation:
1. Monitor for brand impersonation
Track lookalike domains, fake storefronts, fraudulent social media accounts, and unauthorized use of company branding.
2. Strengthen fraud detection
Monitor for unusual transaction activity, card testing, mismatched billing and shipping information, and high-risk geolocations.
3. Educate employees and customers
Warn users about fake discount advertisements and marketplace scams. Encourage verification of website URLs and treat extreme discounts, unfamiliar domains, and unexpected payment verification requests as suspicious.
4. Harden corporate payment practices
Limit corporate card usage on unfamiliar websites and use controls such as virtual cards, spending limits, and transaction alerts. Require immediate reporting of suspected fraudulent purchases.
5. Improve detection and blocking
Use DNS filtering, secure web gateways, and threat intelligence feeds to block known phishing infrastructure. Monitor for access to suspicious domains and newly registered storefront sites.
6. Reduce reliance on OTP-only verification
Where possible, implement stronger authentication and transaction verification controls and encourage phishing-resistant authentication methods for high-risk users.
References
For more information, review the following resources:
If you have any questions about this Cybersecurity Threat Advisory, don’t hesitate to get in touch with Barracuda Managed XDR’s Security Operations Center.
This post originally appeared on Smarter MSP.