10/31/2026
WARNING!!! New SCAM ALERT!! 'The Milk Dragon fake-shop kit"
A security company called Group-IB has just published research on a toolkit criminals rent to run fake online shops. It is called Milk Dragon. They found 258 fake shop pages in 66 countries, built to look like brands such as LEGO and Calvin Klein, and promoted through links on Facebook and TikTok.
These shops do not just take your money for goods that never arrive. They take your card details, and some capture what you type before you even press "pay". Then they show a fake bank page asking for the code your bank sends you, and use it right away to charge your real card. The shop can look completely normal. It has a cart, a checkout and a confirmation page.
Here is what to look for before you pay:
• A big-brand product at a price that makes you stop. Real LEGO is not 70% off in a Facebook ad.
• Look at the web address in the top bar, not the name in the ad. If it is not the brand's own website, do not continue. Try typing the brand's real address yourself.
• Check the website at ListCrime.com. You can look up a website, a phone number or an email address, and it shows what it finds on each. ListCrime collects ALL reports and then lists it as having been reported by the numbers. A site you cannot find there may simply be new, so no listing is not proof that it is safe. If in doubt, give us a shout, we can spot scam Ads within minutes.
• Many of these shops are built on WordPress with a plug-in called WooCommerce. You might notice web addresses with /product/, /cart/ or /checkout/ in them. Millions of honest shops look the same, so this is a clue, not proof.
• A "Pay with PayPal" button that stays on the shop's page and asks for your PayPal login is fake. Real PayPal buttons opens paypal.com.
A bank code request that appears on the shop's page, with no store name and no amount, is a red flag. Your bank's own app should show who you are paying and how much. If it does not match, stop.
If you already entered card details or a code, call the number on the back of your card right now and ask them to block it and review the charges.
Report the ad to Facebook, and report the website, phone number or email to ListCrime.com. Share with someone you know who shops online. If in doubt, give us a Shout, we'll tell you if it's Legit.
https://www.group-ib.com/blog/milk-dragon-nailong-phishing-kit
