Discount lures are widening phishing risk for holiday shoppers

At a glance

What this is: This analysis explains how Milk Dragon, also known as NaiLong, uses discounted shopping offers and fake checkout flows to turn social ads into payment-fraud campaigns.

Why it matters: It matters because retail, payments and IAM teams need to treat seller verification, payment approval and customer reporting as one linked control problem, not separate ones.

By the numbers:

• Researchers identified 258 phishing pages and victims across 66 countries in the Milk Dragon investigation.

Context

Discount lures work because they lower suspicion rather than raise it. In this campaign pattern, the attacker borrows the look of a real retailer and uses a shopping journey instead of a login prompt, which makes detection harder for both customers and the security teams that normally watch for credential theft.

This is a fraud pattern with an identity layer: the attacker impersonates a brand, manipulates trust in the checkout flow and captures payment data before the buyer realises the store is fake. That means brand protection, payment controls and account recovery processes have to be considered together, not as isolated functions.

Key questions

Q: What breaks when phishing controls focus only on fake login pages?

A: Controls tuned only for fake pages miss attacks that use legitimate authentication flows. The user signs in normally, the platform captures the resulting token, and security tools see a valid login instead of obvious credential harvesting. Teams need token-aware detection and session monitoring to close that gap.

Q: Why do discount offers make social-engineering scams harder to detect?

A: A discount creates motivation and lowers scrutiny. People expect promotions in social feeds and marketplace posts, so a fake store can look like a normal commercial opportunity rather than a threat. That means the attacker does not need to manufacture urgency. Security teams should assume that desirable offers can be as dangerous as alarming ones.

Q: How should security teams distinguish payment approval from merchant trust?

A: Treat them as separate decisions. A bank prompt can tell you that a payment can be approved, but it does not prove the store is legitimate. Teams should teach users to verify the merchant, amount and action directly in a trusted banking channel before approving anything, because the scam often depends on that confusion.

Q: What should retailers do first when a suspicious ad or checkout appears?

A: Capture the ad, destination URL, account identity and screenshots, then compare those details against approved campaigns and sellers before taking down the asset. That sequencing helps teams avoid removing a legitimate promotion and makes it easier to trace replacement pages or related accounts. Fast validation matters more than reacting to the discount alone.

Technical breakdown

How adversary-in-the-middle phishing fits a shopping journey

Adversary-in-the-middle phishing sits between the user and the real service, relaying interactions while collecting the data the attacker wants. In a retail scam, the victim does not need to see a corporate login page; the fake storefront and checkout become the interception point. The attacker can present a believable sequence of product selection, payment approval and confirmation while harvesting card data or one-time codes. Because the interaction feels like commerce rather than account recovery, traditional anti-phishing cues such as password prompts or suspension warnings are absent. The real risk is not only credential theft, but the creation of a trusted-looking transaction path that can survive long enough to complete fraud. See the AiTM Phishing Guide.

Practical implication: Treat checkout flows, not just logins, as phishable identity journeys and validate the merchant context before payment approval.

Why social ads and marketplace posts are effective entry points

Social feeds and marketplace posts provide the attacker with a trusted channel and an expected context. When a shopper already expects promotions in that environment, a discounted offer does not stand out as inherently suspicious. The attacker exploits recognition, urgency and the low-friction nature of social commerce to move the victim from an ad to a counterfeit shop. This is why channel trust matters as much as domain reputation. A fake storefront can be technically simple and still succeed if the route into it feels normal. The mechanism is persuasion through context, not technical compromise of the retailer’s infrastructure.

Practical implication: Harden takedown and monitoring around social ad inventory, marketplace seller identity and redirect chains, not just web hosting.

Why payment verification can be confused with seller verification

Payment verification and seller verification solve different problems. A bank approval prompt may confirm that the cardholder can authorise a transaction, but it does not prove the site requesting the code is the legitimate merchant. Attackers use that confusion to create a false sense of safety during a live checkout. The user thinks they are confirming a purchase, while in reality they may be approving a fraudulent transfer or authorisation step. This is a classic trust boundary failure: one system is validating a payment action, while another system is masquerading as the seller. The two signals should never be treated as equivalent.

Practical implication: Separate transaction approval from merchant trust checks and train users to verify the merchant, amount and action independently.

Threat narrative

Attacker objective: The attacker’s objective is to collect payment data and approvals through a believable shopping flow that results in fraud and monetisable account or card abuse.

1. Entry occurs through social ads or marketplace-style posts that advertise discounted goods and direct shoppers into a counterfeit retail journey.
2. Credential or payment data is harvested when the fake checkout captures card details and relays one-time codes through a fraudulent bank-authentication page.
3. Impact follows as the attacker obtains usable payment data and confirmation artefacts that support fraud before the customer realises the store is fake.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
• Mailchimp breach 2022: Attackers socially engineered Mailchimp staff, used a support tool to export 102 customer lists and exposed customer API keys for phishing.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Discount-led phishing is a trust attack, not a password attack. The core trick is that the victim arrives through a desirable offer, not a threatening one, so the usual warning signs never appear. That changes the governance problem for security teams: the question is no longer only how to stop malicious logins, but how to validate commercial identity before a payment journey is allowed to proceed. The practical conclusion is that fraud prevention, brand protection and identity assurance need a shared control model.

Checkout is now an identity boundary. In this pattern, the user is not authenticating to a service account or portal, yet the attacker still relies on trust decisions that resemble identity governance problems. The same logic that governs impersonation, approved channels and trusted workflows applies here, especially when customers are asked to approve a payment or enter a code. Practitioners should treat consumer-facing checkout design as part of the identity control plane, not just the commerce stack.

Campaign reuse makes disruption a lifecycle problem. A reusable phishing kit means the threat does not end when one fake shop is removed. The article’s subscription model shows how operators can spin up replacement assets quickly, which means takedown success must be measured by route disruption, not by single-domain removal. The practical conclusion is that monitoring must follow the campaign, not just the page.

Brand impersonation and payment fraud increasingly overlap. The same lure can borrow retailer identity, move through social platforms and end in payment abuse before conventional security tooling has a chance to help. That convergence forces practitioners to align customer support, payment operations and digital risk teams. The practical conclusion is that response should be built around the customer journey, not around a single control point.

Campaign visibility needs a named concept: discount lure fraud. This is the pattern where an attractive offer replaces an alarming pretext, reducing user resistance and increasing the chance of payment theft. It matters because organisations often optimise for suspicious messages, while this tactic succeeds by looking desirable. The practical conclusion is to build controls that assess offer provenance, channel trust and merchant identity together.

From our research library:

• The IBM/Ponemon 2025 Cost of a Data Breach Report found that phishing-initiated breaches cost an average of $4.8M each.

What this signals

Discount lure fraud: this pattern shows why practitioners should stop treating phishing as a login problem only. When the attacker uses a desirable purchase path, detection has to shift toward merchant provenance, ad-source validation and checkout integrity.

Holiday campaigns widen the attack surface because legitimate promotions, partner activity and unusual shopping traffic all look normal at the same time. For identity and fraud teams, the operational priority is to connect brand monitoring, payment signals and customer reports before a fake store can complete the transaction chain.

For practitioners

• Build a shared holiday fraud playbook Align security, customer service and payments teams on how to verify whether a storefront, ad or checkout is part of an approved campaign before it is escalated or removed.
• Record approved campaign destinations and seller identities Maintain a live list of legitimate domains, storefronts, social handles, ad accounts and support contacts so teams can spot impersonation quickly.
• Create a customer reporting path that avoids payment entry Give shoppers and employees a simple way to report suspicious ads, checkout pages or seller accounts without entering card details or credentials.
• Separate payment approval from merchant verification Train users and support staff to check the merchant name, amount and requested action in the bank prompt before any code or approval is accepted.
• Track takedown effectiveness by campaign route Measure time to validate, time to disrupt redirects, recurrence of replacement assets and how many linked profiles remain active after the first removal.

Key takeaways

• The article shows that fake shopping offers can function as phishing delivery systems even when no login screen is involved.
• The reported investigation covered 258 phishing pages and victims across 66 countries, indicating a campaign with broad reach.
• Teams can limit the damage by joining brand monitoring, payment verification and customer reporting into one response process.

Related NHI Mgmt Group resources: Phishing Guide · MFA Guide · AiTM Phishing Guide · EmeraldWhale Git config credential theft

Key terms

• Adversary-in-the-middle phishing: A phishing method that places an attacker between the user and the real identity provider so the attacker can intercept or relay the authenticated session. It often preserves the user experience, which is why it can evade awareness and some detection paths while still producing usable session tokens.
• Phishing-as-a-service: A criminal service model that packages phishing infrastructure, templates, delivery tools, and sometimes evasion features for reuse by multiple attackers. It lowers the skill threshold for advanced campaigns and makes targeted identity abuse more repeatable across victims and sectors.
• Brand impersonation fraud: A fraud pattern in which attackers mimic trusted organisations to trigger urgent action, capture credentials, or collect payment data. The technical risk sits at the intersection of identity verification, channel assurance, and user trust, which is why security and fraud teams both own the response.
• Invoice Fraud: Invoice fraud is a business email abuse pattern where attackers redirect payments, alter supplier details, or request exceptions using convincing impersonation. The technical weakness is not only message delivery, but the absence of independent validation before financial action is approved.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore nhimg.org for resources that connect identity governance to the broader security disciplines your programme depends on.