- Milk Dragon uses fake ecommerce sites and social media deals to steal payment data
- Malware captures credentials and MFA codes in real time, even before form submission
- Campaign targets victims in 66 countries, abuses trusted brands and banks
If you come across a post on social media promoting huge discounts on big brands like Lego or Calvin Klein, be extra careful, as security researchers Group-IB have warned that these could be fake and part of an elaborate scheme to steal your money.
In their report, the researchers said they uncovered a major scam campaign by a group they call Milk Dragon.
For at least a year, this threat actor has been using a phishing kit of the same name to create spoofed versions of popular ecommerce websites, sometimes even using AI to create completely fake listings.
Latest Videos FromTechRadar
Phishing with a spin
Fake ecommerce sites with offers simply too good to pass up are not a new tactic.
Recent FTC Consumer Sentinel data shows 376,830 reports in the “online shopping and negative reviews” category in 2023, with nearly $400 million in reported losses. The median reported loss was $126, with more than half of the reports involving financial losses.
What makes this campaign unique is that it abuses trusted channels – social media groups and pages – to deliver the attraction. Normally, these lures would be sent via phishing emails, but since email providers have caught on to most tactics and become pretty good at filtering spam, threat actors have turned to the next best thing – social media.
In this case, the listings were mostly shared on Facebook and TikTok, Group-IB said, mainly in groups where users are looking for similar deals. This way, they may not even realize that they are actually being targeted by an advanced infostealer.
As Group-IB explained, the websites come with a piece of malware called BytePress, which captures all the information and sends it to the attackers’ command-and-control panel.
What makes BytePress particularly dangerous is the fact that victims don’t even have to submit the information – simply typing it into the form is enough, as the malware can stream what the victim typifies character by character, in real time.
When the victim finally submits the data, it is forwarded through attacker infrastructure to the legitimate website, which often returns requests for one-time passwords and similar multi-factor authentication. The request is sent back to the victim and recorded again, defeating any multi-factor authentication they have set up.
Buy time
In the end, the victim receives a fake order confirmation, and Milk Dragon displays what appears to be a successful purchase. This way, the victim will believe that everything is fine and will not rush to contact their bank and freeze their credit card or reset their credentials. In the meantime, crooks can use these details in whatever malicious way they want.
Milk Dragon doesn’t seem to target any country or people specifically. It cast a relatively wide net, with victims found in 66 countries around the world. However, according to the Group-IB report, the majority of victims were found in three countries: Malaysia (1,300+), Singapore (1,200+), and Thailand (1,100+).
The group also doesn’t seem particularly fond of a specific brand. A total of 21 popular brands were spoofed, across cosmetics & fashion, food & beverage, home & baby products, as well as the toy industry. Regional supermarkets are also frequent impersonation targets, it seems, as are 36 financial institutions and banks.
The Milk Dragon Phishing Kit is sold on Telegram channels as a service, with various hacking groups paying either monthly or yearly fees. The tool is sold from 300 USDT (crypto currency) per month, with different subscription plans and add-ons.
The best antivirus for every budget
Follow TechRadar on Google News in the add us as a preferred source to get our expert news, reviews and opinion in your feeds.