Fake brand discounts on social media prey on shoppers’ fear of missing out
2026-10-05T14:51:40Z•134f9b137f6542776e9f4c1c3c9df2f68bd15ffadbe4b6f0cb603aeff5e392e1
CVE-2026-96940AI-agent-securityMicrosoft Exchange ServerMilk DragonNaiLongcredential-theftcybercrimefake-discountsmacOS-securitymailbox-data-exposureone-time-password-theftpayment-card-theftphishingsocial-mediavulnerability-management
What happened
The feed reports a phishing campaign operated through the Milk Dragon (NaiLong) phishing kit, using fake brand discounts on Facebook and TikTok to steal payment-card data and one-time passwords. The campaign has been active since October 2025, with 258 phishing pages and victims in 66 countries. It also reports an out-of-band Microsoft Exchange Server update addressing CVE-2026-96940, a high-severity authenticated mailbox-access vulnerability that could expose other users’ emails and attachments. Additional items cover AI-agent security and governance products, scam-link analysis, macOS access
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- helpnetsecurity
- Record identifier
- 134f9b137f6542776e9f4c1c3c9df2f68bd15ffadbe4b6f0cb603aeff5e392e1
- Enrichment time
- 2026-10-05T14:51:40Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.