Fake “Discount” Ads on Facebook & TikTok Funnel Shoppers into Credential‑Stealing Phishing Sites
What Happened – A campaign dubbed Milk Dragon (aka NaiLong) has been posting bogus “big‑discount” offers for 21 well‑known brands on Facebook Marketplace and TikTok. The links lead to WordPress/WooCommerce sites that use a custom “BytePress” plugin to capture credit‑card numbers and one‑time passwords in real time via a WebSocket C2 channel. The operation has been active since Oct 2025, with 258 phishing pages targeting victims in 66 countries.
Why It Matters for Trust & Control Assurance
- The attack exploits the fear of missing out (FOMO) to bypass typical phishing cues, highlighting the need for continuous security‑awareness training and simulated phishing exercises.
- Real‑time capture of payment credentials demonstrates a gap in identity‑verification controls and the importance of monitoring outbound traffic from web‑applications for anomalous C2 connections.
- The use of legitimate e‑commerce plugins (WooCommerce) shows why control‑mapping and evidence collection for third‑party components are essential for audit readiness.
Who Is Affected – Retail and e‑commerce operators, marketplace platforms, and any organization that runs consumer‑facing web stores (e.g., fashion, cosmetics, food & beverage, toys).
Recommended Actions
- Incorporate FOMO‑focused phishing simulations into your security‑awareness program and track completion rates.
- Deploy web‑application firewalls (WAF) and continuous network traffic monitoring to detect unauthorized WebSocket connections to external C2 servers.
- Inventory all third‑party plugins (e.g., WooCommerce, custom checkout extensions) and map them to control objectives for continuous evidence collection.
Source: Help Net Security
Technical Notes – The phishing flow uses a WordPress site with WooCommerce plus a malicious “BytePress” plugin that injects fake payment fields and maintains a persistent WebSocket to the attacker’s C2. Victims’ card data and 3‑DS OTPs are exfiltrated character‑by‑character before the form is submitted. No CVE is cited; the threat is a phishing‑as‑a‑service operation.