Milk Dragon, also known as NaiLong, is a phishing kit that uses fake online stores to steal payment information and authentication codes.
Group-IB researchers identified 258 phishing pages linked to the operation since October 2025, with victims across 66 countries. The attacks combine legitimate WooCommerce checkout pages with a malicious WordPress plugin called BytePress.
Unlike phishing campaigns built around urgent banking alerts or delivery problems, Milk Dragon attracts shoppers with large discounts.
Operators promote fake offers through Facebook and TikTok listings, using familiar brands and everyday products to make their advertisements appear trustworthy.
Researchers observed impersonation of 21 brands across fashion, cosmetics, food, household products, and toys.
Examples included LEGO, Calvin Klein, and Aeon Malaysia. The kit also included 36 financial institution templates for capturing authentication information.
Milk Dragon Targets WooCommerce
Shoppers who follow the advertisements reach WordPress websites disguised as legitimate retailers. These sites use WooCommerce to create familiar shopping and checkout pages. The malicious activity comes from BytePress, a separate plugin installed alongside the legitimate commerce software.
BytePress inserts fake credit card and PayPal payment options into the checkout process. Its settings page includes an “API Base URL” field that connects the fraudulent store to the operator’s command-and-control panel.
The plugin establishes a persistent WebSocket connection using Socket.IO between the victim’s browser and the criminal backend. This connection streams payment inputs character by character, allowing operators to collect information before the shopper submits the form.
Operators can also change the pages shown to victims, display custom messages, and accept, reject, or block submitted payment details. This live control helps attackers adjust the deception while a shopper remains on the website.
After collecting card information, the site displays a fake loading screen. Operators then direct victims to counterfeit verification pages matching authentication challenges from legitimate 3D Secure payment services.
When a victim enters a one-time password, the operator can relay it to authorize a fraudulent transaction. This adversary-in-the-middle workflow targets the authentication process rather than relying only on stolen card numbers.
A fake order confirmation page completes the deception, making shoppers believe their purchase succeeded and potentially delaying fraud reports or card cancellation.
Milk Dragon has been sold through Telegram communities since at least October 2025. Subscriptions start at 300 USDT per month, with additional plans and optional features. Developers provide updates and support, helping affiliates maintain their operations, Group-IB said.
The central panel supports multiple phishing websites, role-based operator accounts, browser alerts, and Telegram notifications. It records visitor activity, order statistics, payment details, personal information, and device metadata.
Affiliates can deploy a containerized panel through an installation interface that requests server connection details. Supporting database and API services are configured automatically, reducing setup complexity.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
