Threat Intel
Milk Dragon Phishing Kit Exploits Social‑Media Discount Ads
Milk Dragon, an AiTM phishing kit launched in October 2025, lures victims with fake discount offers on Facebook and TikTok marketplace ads. The campaign targets consumers shopping for consumer goods and can compromise credentials and personal data. Defenders should block suspicious links, verify ad URLs, and deploy XDR and MFA.
What Happened
Since October 2025, the Milk Dragon (also called NaiLong) adversary‑in‑the‑middle kit has been active on Facebook and TikTok marketplace advertisements. Instead of using fear‑based tactics, the kit advertises large discounts on consumer goods, enticing users to click on malicious links that redirect to credential‑stealing pages.
Who Is Affected
Anyone who clicks on the discount ads on Facebook or TikTok marketplace, especially shoppers looking for electronics, apparel, or household items. The phishing pages mimic legitimate e‑commerce sites, making it difficult for users to detect the fraud.
Impact
Victims may unknowingly submit usernames, passwords, and payment details to the attacker. The stolen credentials can be used for account takeover, credential stuffing, or further social‑engineering attacks.
What to Do
Defenders should implement the following controls:
- Block or filter URLs that match known Milk Dragon domains or patterns.
- Deploy an XDR solution that correlates phishing link clicks with credential theft indicators.
- Enforce MFA on all user accounts to mitigate credential compromise.
- Educate users to verify the authenticity of discount offers and to hover over links to check the destination URL before clicking.
- Monitor for unusual login activity from new devices or geographic locations following a click on a marketplace ad.
Related vulnerabilities
Disruption of Chinese Phishing Kit Ecosystem: Storm-2990 & YAM Store
Microsoft’s Digital Crimes Unit exposed a Chinese‑language phishing kit ecosystem, including the Storm‑2990 developers and the YAM Store marketplace (Storm‑3119). The network distributed over 1 billion phishing emails and SMS to more than 75 000 organizations in healthcare, finance, wholesale, and IT sectors across Japan, the U.S., Australia, and India. Defenders should block known phishing kit domains, monitor for compromised cloud credentials, and apply Microsoft Defender detections.
Read briefing
BlueKit Phishing-as-a-Service Enables Rapid Account Hijacking
BlueKit, a turnkey phishing platform, lets attackers launch sophisticated account‑hijacking campaigns in minutes. The kit includes a command center, tracking, and a library of 97 brand templates. Defenders should block known BlueKit domains, monitor for phishing emails, and harden MFA on high‑risk accounts.
Read briefing
Outsider Phishing Kit: 267 Templates Targeting 54 Countries – What SecOps Need to Know
The Outsider phishing kit, developed by Chenlun, has 267 ready‑made templates that have been used to target more than 54 countries. The kit’s persistence and breadth make it a high‑severity threat for organizations worldwide. Defenders should block known phishing domains, monitor for suspicious email patterns, and deploy email protection solutions.
Read briefing
Tycoon 2FA AiTM: The Phishing‑as‑a‑Service Threat That Bypasses MFA on Entra ID & Google Workspace
Tycoon 2FA, the top‑selling phishing‑as‑a‑service kit, has evolved into a sophisticated adversary‑in‑the‑middle tool that captures MFA‑protected session tokens for Microsoft 365 and Google Workspace. After a March 2026 takedown, operators pivoted to device‑code phishing and OAuth abuse, keeping the kit at the forefront of global phishing trends. Elastic’s new detection rules map telemetry fingerprints across both platforms, enabling rapid incident containment in under ten seconds via Elastic Workflows.
Read briefing