Phishing Without the Panic: Inside Milk Dragon’s Discount Lures

The ad has your favorite brand, a price that feels like a small victory, and a checkout that looks perfectly ordinary. Nobody’s threatening to close your account. Nobody’s pretending you owe a fine. You’re shopping, and the scam is happy to let you enjoy yourself.

Milk Dragon, also known as NaiLong, is an adversary-in-the-middle phishing kit that uses discounted products to lure shoppers into fraudulent checkout flows. It trades the account-security scare for something more inviting: a good deal.

For retailers and financial institutions heading into the Q4 shopping season, that change matters. An attack can reach a customer through a social ad, borrow a retailer’s identity, and end in payment fraud before an email security tool can intervene.

What is Milk Dragon?

Group-IB’s October 1, 2026 investigation, covered in recent reporting (opens in new tab), described activity dating to October 2025. Researchers identified 258 phishing pages and victims across 66 countries. Those figures reflect the investigation’s observed scope, not a complete worldwide tally.

The kit is sold through Telegram as a subscription service. That puts it in the phishing-as-a-service (PhaaS) economy, where operators can rent tooling instead of developing an attack from scratch.

The practical concern is repeatability. A reusable kit gives different operators a starting point for fresh campaigns. Removing one fake shop can help, but a response plan also needs to account for the next shop and the channels sending people there.

Here’s the lesson to carry into holiday planning: a phishing page doesn’t need to resemble a corporate login screen. A familiar shopping experience can collect equally sensitive information.

Why a discount works where a warning wouldn’t

Security advice often focuses on pressure: slow down when a message says your account will be suspended or your package is stuck. That’s useful advice, but it leaves a gap when the invitation feels pleasant.

A bargain gives someone a reason to move forward. The shopper provides the motivation, so the attacker has less to explain. A toy, a beauty product, or an everyday grocery offer can feel much more believable than an unexpected email from an executive.

Several ordinary shopping habits can make the approach persuasive:

• Recognition comes first. A familiar logo and product photo can make an unfamiliar seller feel established before the shopper checks the address.
• The channel supplies context. People expect recommendations and promotions in a social feed. An ad blends into an activity they already chose.
• Discounts make the detour feel worthwhile. A shopper might accept an unfamiliar checkout because the savings seem to justify the extra step.
• Small purchases can lower scrutiny. Someone might spend less time checking a low-cost order, even though the payment details are valuable.

These are reasons to design better checks, not to blame shoppers. Legitimate retailers use the same visual cues and promotional habits. The challenge is verifying who’s behind the offer.

From the social feed to a fraudulent checkout

The reported Milk Dragon flow is straightforward enough to fit into an ordinary shopping session:

1. The offer attracts a click. Facebook and TikTok ads or marketplace-style posts promote discounted goods.
2. The shop borrows a brand. A counterfeit retail page leads the shopper to a checkout.
3. Payment verification becomes the trap. Operators capture payment details and relay one-time codes through fake bank-authentication pages.
4. A confirmation preserves the story. A fake order confirmation encourages the shopper to believe the purchase worked.

That sequence helps explain the wider risk of online shopping scams. An attacker can stitch familiar moments together so each step feels like a continuation of the last.

Consider the difference between finding an unknown site in a search and arriving there from an apparently relevant product ad. In the second case, the shopper has already formed an expectation: this is where they'll buy the item. The checkout benefits from that expectation.

A confirmation screen can reinforce it. The customer might wait for shipping news instead of reviewing the card account immediately. The key question for a brand is how quickly it can report a suspicious offer while the transaction still feels routine.

Verification codes don’t prove a shop is genuine

Payment authentication and seller verification answer different questions. A bank might check whether someone can approve a transaction. That doesn’t establish that the website asking for information belongs to the retailer whose logo it displays.

This distinction is easy to lose in a smooth checkout. Shoppers expect extra verification, so another screen can feel reassuring. It helps to teach a more concrete habit: read what the bank’s message says the code or approval is for.

If the merchant, amount, or action doesn’t match the purchase you intended, stop. Open the bank’s app directly or call the number on your card. Don’t let the page that raised the concern supply the explanation and the contact details.

Multi-factor authentication still adds protection. A captured code also doesn’t mean every account or authentication method has been defeated. The risk is persuading someone to hand over a usable approval during a live scam.

What Q4 changes for retail security teams

Holiday campaigns create a busy backdrop for this kind of deception. Brands launch new creative, partners run promotions, and shoppers encounter unfamiliar offers. A sale itself tells you very little about whether a page is legitimate.

That makes preparation more useful than a general warning to be careful. Before a major promotion, give security and customer-service teams a shared view of the real campaign:

• Approved destinations: Record the domains, storefronts, and checkout routes the campaign actually uses, including authorized partners.
• Official identities: Keep an up-to-date list of social handles, ad accounts, and support contacts so you can more easily assess an imitation.
• A reporting route: Give customers and employees a simple way to submit a suspicious ad or shop without entering payment information.

This reference set helps a team distinguish a legitimate reseller from marketplace seller fraud. A big discount is a lead to investigate, not enough evidence for removal.

Customer service belongs in this process. A report about a missing order, an unfamiliar charge, or a store the brand doesn’t recognize can reveal a campaign that a domain alert hasn’t yet explained.

A practical response to a suspicious discount campaign

Treat the ad, account, and checkout as connected parts of a customer journey. A customer-targeted phishing response is more useful when the team understands how people reached the fake shop.

1. Preserve the lead. Capture the ad or post URL, account identity, destination, timestamps, and screenshots. Avoid entering real customer or payment data.
2. Validate the impersonation. Compare the assets with approved campaigns and sellers. Record what establishes deception rather than relying on price alone.
3. Trace the route. Identify redirects, related pages, reused contact details, and other profiles pointing to the same destination.
4. Submit the relevant reports. Send evidence to the social platform, ad network, host, or registrar based on the asset involved.
5. Check what’s still reachable. Verify the result, watch for replacement assets, and tell support teams what customers may have encountered.

An unavailable checkout is progress. A live ad pointing to a replacement checkout is unfinished work. Tracking both makes the response easier to evaluate and helps avoid declaring success too early.

Useful measures include time to validate, time to disrupt the customer’s route, recurrence, and the number of connected assets still active. Detection counts alone won’t tell you whether a shopper can still reach the scam.

What shoppers should do before and after checkout

The safest habits work across brands and campaigns. They don’t require someone to recognize the name of a phishing kit:

• Start from a known destination. Find the offer through the retailer’s established website or app, rather than trusting the ad’s link.
• Check the seller. Confirm an unfamiliar retailer or marketplace seller independently. A polished page and a padlock don’t establish identity.
• Match the approval to the purchase. Read bank prompts carefully and stop if the amount, merchant, or requested action differs.
• Report exposed payment details promptly. Contact the issuer through its app or the number on the card, even if the shop displayed a successful order.

If you’ve paid a scammer, contact the payment provider and ask about recovery (opens in new tab). Save the page address, receipts, messages, and transaction details. If you reused a password, change it through the genuine service.

A customer warning should make these steps easy to follow. Show where legitimate offers appear, explain how to report a suspicious page, and give people a trusted route to support. “Be vigilant” is a slogan; a usable contact path is help.

How Doppel connects parts of the campaign

A discount lure crosses several boundaries: the social platform hosting the offer, the retailer being impersonated, the fake website collecting information, and the financial service involved in payment. Separate reports can leave each team seeing only part of the route.

Doppel’s Threat Graph connects signals such as spoofed domains, fake profiles, scam ads, and malicious messaging. That campaign view helps analysts investigate related assets and prioritize disruption.

Brand Protection supports monitoring and enforcement across the external channels where impersonation reaches customers. It complements payment controls by addressing the assets that bring people into the scam.

For Q4, the aim is practical: Reduce how long an imitation stays available, make customer reports easier to act on, and keep checking the route after the first removal. The discount might be fictional. The work needed to interrupt it isn’t.

Is your team prepared to connect a fake social offer to the checkout behind it before more customers enter their card details? Request a Doppel demo to see how campaign detection and takedowns fit together.