Fake Social Ads Push Shoppers to Card-Stealing Sites

How the attack worked

The operation, tracked as Milk Dragon (also called NaiLong), relies on fake discount posts placed in social media marketplace listings on Facebook and TikTok. These posts advertise steep, exclusive discounts on popular brands and consumer goods to catch attention. Clicking the link redirects the shopper to a WordPress site disguised as a legitimate online retailer selling the discounted products. The checkout flow captures card details in real time, then shows a fake loading screen before presenting a spoofed 3D Secure verification page that mirrors a real bank's 2FA challenge. When the victim enters the one-time password, the operator relays it to approve a fraudulent transaction or take over the account. The kit has reportedly been linked to over 250 phishing pages affecting victims across dozens of countries, with an operator panel that stores victim profiles and supports templates tailored to multiple financial institutions.

Why it succeeded

The scheme leans on fear of missing out rather than fear or urgency tied to a security threat. Steep, time-limited discounts on recognizable brands push shoppers to act quickly without scrutinizing the source of the link. Because the traffic originates from ordinary-looking marketplace posts rather than obvious spam, it blends into normal social media browsing. The fake checkout and spoofed verification page are designed to mimic the real purchase and 3D Secure flow closely enough that most shoppers see nothing unusual until after the fraud occurs.

What to watch for

• Marketplace listings or social posts advertising unusually steep or short-lived discounts on well-known brands
• Links that lead away from a brand's official site to an unfamiliar storefront domain
• A one-time password request appearing during or after checkout on a site reached through a social media link
• Checkout behavior that feels unusual, such as odd loading screens or verification steps that don't match a bank's normal process

Building resistance

Shoppers should treat exclusive, time-pressured discounts found through third-party marketplace links as a warning sign rather than a bargain, and buy directly from a brand's verified site when possible. Before entering a one-time password at checkout, confirm the page genuinely belongs to the bank or card issuer rather than a lookalike verification screen. Anyone who has entered card details on a suspicious site should contact their bank or card issuer immediately to limit potential fraud. Organizations responsible for brand protection should monitor for lookalike domains, request takedowns early, and watch for unusual checkout patterns or suspicious card activity tied to their brand.

How does the Milk Dragon phishing scheme work?

Fake discount ads on Facebook and TikTok link to lookalike online stores. Once a victim enters payment card details, the site presents a spoofed 3D Secure verification page to steal their one-time password as well.

What should I do if I entered my card details on a suspicious site?

Contact your bank or card issuer right away to flag the activity and limit fraud, since the attackers can use stolen card details and OTPs to approve fraudulent transactions or take over accounts.

What red flags indicate a fake discount scam?

Steep or time-limited discounts posted on social media marketplace listings, links that bypass a brand's official site, and unexpected requests for a one-time password during checkout are all warning signs.

Can brands protect themselves from this kind of impersonation?

Yes, companies are advised to watch for lookalike domains, request takedowns early, and monitor for suspicious card activity and unusual checkout patterns.