These social media posts promise huge online discounts on Lego, Calvin Klein, and more, but they’re actually just phishing scams.
- Milk Dragon uses fake e-commerce sites and social media offers to steal payment data
- Malware captures credentials and MFA codes in real time, even before form is submitted
- The campaign targeted victims in 66 countries, abusing trusted brands and banks.
If you come across a social media post promoting huge discounts on major brands like Lego or Calvin Klein, be very careful, as security researchers Group-IB have warned that they could be fake and part of an elaborate scheme to steal your money.
In their report, investigators said they uncovered a major scam campaign run by a group they call Milk Dragon.
For at least a year now, this threat actor has been using a phishing kit of the same name to create spoofed versions of popular e-commerce websites, sometimes even using artificial intelligence to create completely fake listings.
Latest videos ofTechnologyRadar
Spin phishing
Fake e-commerce sites with deals too good to pass up are not a new tactic.
Recent data from the FTC Consumer Sentinel shows 376,830 reports in the “online purchases and negative reviews” category in 2023, with nearly $400 million in reported losses. The median reported loss was $126, and more than half of the reports involved financial losses.
What makes this campaign unique is that it abuses trusted channels (social media pages and groups) to deliver the lure. Typically, these lures are sent via phishing emails, but since email providers have caught up with most of the tactics and become quite good at filtering out spam, threat actors turned to the next best thing: social media.
In this case, the listings were mainly shared on Facebook and TikTok, Group-IB said, mainly in groups where users search for similar offers. That way, they may not even realize that they are actually being attacked by an advanced information thief.
As Group-IB explained, the websites come with malware called BytePress that captures all submitted information and sends it to the attackers’ command and control panel.
What makes BytePress particularly dangerous is the fact that victims don’t even have to submit the information: they simply type it into the form, as the malware can transmit what the victim types character by character, in real time.
When the victim finally submits the data, it is transmitted through the attacker’s infrastructure to the legitimate website, which often returns requests for one-time passwords and similar multi-factor authentication. The request is returned to the victim and responded to again, overriding any multi-factor authentication they may have set up.
gaining time
In the end, the victim will receive a fake order confirmation and Milk Dragon will display what appears to be a successful purchase. That way, the victim will believe that everything is in order and will not rush to contact their bank and freeze their credit card or reset their credentials. Meanwhile, criminals can use those details in any malicious way they want.
Milk Dragon does not appear to be targeting any country or person specifically. It cast a relatively wide net, with victims found in 66 countries around the world. However, according to the Group IB report, the majority of victims were found in three countries: Malaysia (more than 1,300), Singapore (more than 1,200) and Thailand (more than 1,100).
The group also doesn’t seem to particularly like any specific brand. A total of 21 popular brands were counterfeited, across cosmetics and fashion, food and beverages, household and baby products, as well as toy industries. Regional supermarkets are also reportedly frequent targets of phishing, as are 36 financial institutions and banks.
The Milk Dragon phishing kit is sold on Telegram channels as a service, with several hacking groups paying monthly or annual fees. The tool sells from 300 USDT (cryptocurrency) per month, with various subscription plans and add-ons.
The best antivirus for all budgets
Follow TechRadar on Google News and add us as a preferred source to receive news, reviews and opinions from our experts in your feeds.
Post Comment