Social Feeds as Attack Pads: The Phishing Kit Turning Discounts into Data Theft

What looks like a bargain post can become a credential trap. The Milk Dragon phishing kit, also tracked as NaiLong, is built around a simple social-engineering idea: make the victim want the deal first, then move them into a fake workflow that can collect sensitive data and challenge-response information. The draw is not novelty for its own sake. It is scale, repetition, and a design that fits how people actually browse and buy online.

Fast Facts

• Milk Dragon, also called NaiLong, is described as a phishing-as-a-service operation.
• The kit uses discount-themed Facebook and TikTok posts as the lure.
• Researchers linked 258 phishing pages to the kit since October 2025.
• Victims were reported across 66 countries.
• The operation is associated with payment-card theft and MFA challenge interception.

Why this kit matters

The technical danger here is not just phishing, but phishing built as a service. That matters because it lowers the barrier for operators to recycle templates, swap brands, and keep campaigns moving. Instead of a one-off scam page, defenders may be facing a commodity workflow that can be relaunched quickly after takedown attempts.

Just as important, the campaign fits a modern pattern: it does not rely on old-style delivery-failure notices or account-lockout warnings. It leans on social-commerce behavior, where a discounted item or limited-time offer can feel more believable than an urgent security email. That shift widens the attack surface from inboxes to feeds, posts, and marketplace-style interactions.

The MFA angle is especially sensitive. The available evidence supports interception or bypass of phishable MFA flows, not the breaking of all MFA. That distinction matters. Phishing-resistant methods such as passkeys or hardware-backed keys remain materially stronger because they are designed to resist proxying and token capture. In other words, the problem is often not that MFA failed in theory, but that the chosen MFA method was still usable by an attacker in the middle of the session.

At the time of writing, public information does not fully establish how the 258 pages were distributed over time or whether the 66-country figure refers strictly to victims, targeting, or both. The available information supports a risk analysis, not a definitive claim that every account or payment flow was successfully compromised.

What defenders should watch

For security teams, the lesson is straightforward: if users can be led from a casual social post into a login or checkout page, the trust boundary is already in the wrong place. Look for suspicious short-lived domains, duplicate payment forms, fake order confirmations, and authentication prompts that appear immediately after a click from social content. From a defensive perspective, the strongest controls are phishing-resistant MFA, user reporting channels, and policies that reduce the value of stolen sessions.

The broader warning is that cybercrime is increasingly packaging deception as a service. When the lure, the phishing page, and the authentication interception are assembled into one reusable kit, social platforms stop being just communications channels and start functioning as delivery infrastructure for fraud.

Conclusion

Milk Dragon is a reminder that modern phishing is less about a bad email and more about a manipulated journey. The real lesson is not to trust the discount, the platform, or the prompt at face value. In today’s threat model, the safest assumption is that any convenient shortcut to a deal may also be a shortcut to theft.

TECHCROOK

Hardware security key: A small device for phishing-resistant MFA on accounts that support passkeys or FIDO2/WebAuthn. It adds a physical step to sign-ins and is useful for email, cloud, and admin accounts. Keep a backup key stored securely.

Scheda Techcrook: Hardware security key

WIKICROOK

• Phishing-as-a-Service (PhaaS): A subscription-style criminal model that sells phishing kits and infrastructure to other operators.
• MFA challenge interception: A tactic where an attacker relays or captures the authentication step needed to complete login.
• Phishing-resistant MFA: Authentication methods, such as passkeys or hardware keys, that are designed to resist proxy attacks.
• Social engineering: The use of manipulation and trust cues to get a victim to click, sign in, or share data.
• Payment-card data: Information from a debit or credit card that can be abused for fraudulent purchases or account abuse.