In the weeks before Black Friday, shoppers go looking for a deal. They join bargain groups, follow brand pages and click on promotions they would usually scroll past. Scammers are paying attention too.
Researchers at Group-IB have been tracking Milk Dragon, a phishing kit that uses fake brand discounts on Facebook and TikTok to direct shoppers to cloned online stores. Since October 2025, it has been linked to 258 phishing pages, 21 impersonated brands and victims in 66 countries.
Rather than relying on phishing emails or account warnings, Milk Dragon uses the appeal of a good deal. The shopper sees a brand they recognise, a store that looks legitimate and a checkout that feels like any other, and they’re asked to enter their card details.
For retailers, the brand being impersonated often has no involvement in the ad, the store or the transaction. But it’s usually the brand customers associate with the experience.
What Milk Dragon Is and How It Works
Milk Dragon, also known as NaiLong, is sold as phishing-as-a-service in Telegram communities, with pricing starting at around US$300 per month, paid in cryptocurrency. Subscribers get access to the kit, a control panel, updates and ongoing support. That means the same tooling can be used by multiple operators targeting different brands and regions at the same time.
Group-IB’s research describes a journey that takes a shopper from a social media post through to a fraudulent payment:
A discounted product is advertised on Facebook or TikTok, often in bargain-hunting groups or marketplace listings.
The shopper is redirected to a WordPress website designed to look like the brand's official online store.
A malicious plugin called BytePress adds fake payment options to the WooCommerce checkout and streams card details to the operator as they're typed.
A fake verification page asks for the one-time password sent by the shopper's bank, which the operator uses in real time to approve a fraudulent transaction.
The shopper is shown a fake order confirmation, which can delay them from contacting their bank or cancelling their card.
The panel behind the kit also stores card, personal and device details for each victim, which can be reused to target the same people again.
Inside a Fake Store
Group-IB names LEGO, Calvin Klein and Aeon Malaysia among the brands impersonated, with fake pages also covering electronics, toys, supermarket groceries and beauty products. Across the campaign, the 21 brands span cosmetics and fashion, food and beverages, home and baby products, toys and regional supermarkets.
These stores can be convincing because they’re built on the same tools as many legitimate online shops. WordPress and WooCommerce give the scammer a familiar layout, product pages, cart and checkout, while the BytePress plugin does its work in the background.
The ads themselves appear natively in Facebook and TikTok marketplaces, and some of the profiles sharing them contain AI-generated content. At each step, the shopper is given a reason to keep going:
Why Brands Take the Blame
A retailer may have no involvement in the ad, the account promoting it or the website it leads to. From the shopper’s point of view, though, they paid the brand and the order never arrived.
For the brand, that can mean customer service enquiries about orders that don’t exist, complaints on social media and review platforms, and a loss of trust that can be difficult to win back. Some shoppers may never realise the store wasn’t legitimate.
Because the fake order confirmation delays detection, these complaints often arrive after the store has already been used against a number of customers. By then, the operator may have moved on to a new domain.
Why the Weeks Before Black Friday Are the Riskiest
Most of Milk Dragon’s victims so far have been in Malaysia, Singapore and Thailand, with TechRadar reporting more than 1,000 victims in each. But the kit isn’t tied to one region. It’s available to anyone willing to pay, and Group-IB found 36 different bank verification templates, matched to the geography of each campaign.
The lead-up to Black Friday creates the conditions this type of campaign relies on. Shoppers expect large discounts, brands are running more promotions than usual and bargain groups become more active. A heavily discounted offer is less likely to stand out as suspicious when so many brands are advertising one.
The kit’s panel also supports one-click deployment, so new stores can be set up quickly. When one is removed, another can take its place.
Protecting Retailers from Fake Stores
Group-IB recommends that organisations monitor for lookalike domains and begin takedowns before campaigns scale. For retailers, that visibility needs to extend beyond the brand’s own website and social media accounts.
A campaign like Milk Dragon can involve social media ads, fake profiles, marketplace listings and cloned websites, all connected to the same operation. Looking at each one in isolation can make it harder to see the wider campaign, and harder to disrupt it.
Unphish monitors for brand impersonation across domains, websites, social media and paid advertising, including lookalike domains, cloned websites, fraudulent social ads and misleading promotions. Related detections can be grouped through shared infrastructure and other indicators, helping teams understand whether a fake store is part of a broader campaign. Confirmed threats can then be progressed through evidence-backed takedown and escalation with the relevant registrar, host or platform.