Group-IB Exposes Milk Dragon Phishing Scam Across 66 Countries
Group-IB says the Milk Dragon phishing kit spoofed 21 brands and 36 financial institutions, with fake discount posts on Facebook and TikTok.
Group-IB researchers have published a report uncovering a phishing campaign run by a group it calls Milk Dragon, which used a phishing kit to create spoofed versions of popular ecommerce websites.
The campaign spread fake discount listings on Facebook and TikTok, drawing victims into the spoofed sites. According to Group-IB, a malware called BytePress captured information as victims typed it into forms in real time, and the scheme defeated multi-factor authentication requests.
Victims were found in 66 countries, with the highest numbers in Malaysia, Singapore and Thailand. The operation spoofed a total of 21 popular brands and 36 financial institutions.
The Milk Dragon phishing kit is sold on Telegram channels from 300 USDT per month, according to the report.
Earlier context
Background details from the report note that spoofed brands include Lego and Calvin Klein, and that the threat actor has been using the phishing kit for at least a year. Separately, FTC Consumer Sentinel data shows 376,830 reports in the "online shopping and negative reviews" category in 2023.
Quick answers
What is Milk Dragon?
Milk Dragon is the name Group-IB uses for a group running a phishing campaign that creates spoofed versions of popular ecommerce websites using a phishing kit.
How does the BytePress malware work?
BytePress captures information as victims type it into forms in real time, and the scheme defeated multi-factor authentication requests, according to Group-IB.
How much does the Milk Dragon phishing kit cost?
It is sold on Telegram channels from 300 USDT per month.