# Milk Dragon (NaiLong) AiTM Phishing-as-a-Service Kit Targeting Social Media Shoppers and Bank MFA

> Group-IB details Milk Dragon (NaiLong), an Adversary-in-the-Middle phishing kit sold as PhaaS on Telegram from 300 USDT per month. It spreads through Facebook and TikTok marketplace ads and posts offering heavily discounted goods, using fake WordPress/WooCommerce storefronts and a custom 'BytePress' plugin for C2, real-time keystroke capture, and 3D Secure MFA interception and relay.

- **Published:** 2026-10-01T00:00:00Z
- **Last reviewed:** 2026-10-01T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2834
- **ID:** TL-2026-2834
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 14 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Milk Dragon (also tracked as NaiLong) is an Adversary-in-the-Middle (AiTM) phishing kit distributed as Phishing-as-a-Service (PhaaS) through Telegram communities, priced from 300 USDT per month with various subscription plans and add-ons. Group-IB reports it has been active since October 2025 and identified 258 phishing pages with victims across 66 countries. Unlike fear-based phishing, the lure is commerce: heavily discounted consumer goods advertised through Facebook and TikTok marketplace ads and organic posts, in some cases from potentially AI-generated profiles with purchased followers to appear legitimate. Impersonated storefronts span 21 consumer brands (cosmetics, fashion, food and beverage, home/baby products, toys; e.g. LEGO, Calvin Klein, Aeon Malaysia) plus regional supermarkets.

The phishing sites are fake WordPress/WooCommerce storefronts. A second, custom plugin called BytePress is installed alongside WooCommerce and provides the command-and-control link: it adds fake credit card and PayPal payment methods and exposes an 'API Base URL' configuration field that ties the fraudulent checkout to the operator's C2 panel. BytePress keeps a persistent socket.io WebSocket connection to the panel, streaming the victim's input character by character without a form submission, so card data is captured in real time even if the checkout is abandoned.

The operator panel is connected directly to live phishing pages. It supports multiple accounts with role-based access control, Telegram bot notifications on victim activity, BIN-based card identification with automatic bank tagging, live session monitoring with keystroke capture, and centralized storage of domain visits, conversion rates, visitor details and card data. The panel is deployed in Docker through an automated installer that uses SSH credentials and auto-provisions the SQL database and API services; hosting is supplied by affiliates.

After card capture, the operator steers the victim to a matching 3D Secure/OTP page. The kit has 36 financial-institution impersonation templates for 2FA/3DS pages, customizable by geolocation. The victim enters the one-time code on the spoofed page and the operator relays it to the legitimate 3DS site to authorize a fraudulent transaction or take over the account. A fake turnstile loading page serves as a distraction during the relay, and the victim is then shown a fake confirmation page. Collected data is retained in the panel for re-targeting.

Group-IB states that full IOCs are restricted to its customers (Threat Intelligence portal), and the report names no individual actors, domains, IPs or hosting providers. No CVEs are involved; the kit abuses legitimate software (WordPress, WooCommerce, socket.io, Docker) and legitimate platforms (Facebook, TikTok, Telegram). Attribution is therefore unknown. The IOC set below is limited to publicly stated artifacts (tooling, platforms, behaviors, impersonated brands).

## MITRE ATT&CK

- T1585.001 Social Media Accounts
- T1583.001 Domains
- T1587.001 Malware
- T1566.003 Spearphishing via Service
- T1204.001 Malicious Link
- T1684.001 Impersonation
- T1557 Adversary-in-the-Middle
- T1111 Multi-Factor Authentication Interception
- T1056.001 Keylogging
- T1071.001 Web Protocols
- T1657 Financial Theft

## Sources

- [Milk Dragon: Huge Discounts on Social Media? Think Twice Before You Buy](https://www.group-ib.com/blog/milk-dragon-nailong-phishing-kit/)
- [Group-IB: Phishing kits (background)](https://www.group-ib.com/blog/phishing-kits/)
- [Group-IB: Telegram bots and Google Forms used to automate phishing (background on Telegram exfiltration)](https://www.group-ib.com/media-center/press-releases/phishing-automation/)
- [MITRE ATT&CK T1557 Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557/)
- [MITRE ATT&CK T1111 Multi-Factor Authentication Interception](https://attack.mitre.org/techniques/T1111/)
- [MITRE ATT&CK T1566.003 Phishing: Spearphishing via Service](https://attack.mitre.org/techniques/T1566/003/)
- [MITRE ATT&CK T1656 Impersonation](https://attack.mitre.org/techniques/T1656/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2834