DoppelCart fraud network uses 119,000 fake shops to steal credit cards
DoppelCart, the largest documented fake-shop network, runs 119,000 domains impersonating 44,182 brands to steal payment card details via WebSocket-connected checkout pages.
German cybersecurity startup Nebty discovered DoppelCart, a network of more than 119,000 fake e-commerce domains, mostly in the .SHOP TLD, that harvest payment card details through fraudulent checkout pages. Over 105,000 shops remain active, impersonating 44,182 brands with discounts of up to 65%, and 96% of confirmed shops share identical build files resolving to 27 commerce backends. Checkout code exfiltrates card numbers, expiration dates, CVVs, cardholder names, contact details, and even bank one-time codes to attacker C2 over WebSockets in real time, potentially bypassing bank security controls. The network surpasses BogusBazaar, the previously largest documented fake-shop cluster with 75,000 sites and an estimated 850,000 fraudulent transactions.
- 105,000+ shops are still active; 96% share identical build files and resolve to 27 commerce backends.
- Impersonates brands like SodaStream, Daniel Wellington, and CurrentBody with over 30 clone shops each.
- Checkout code relays bank one-time confirmation codes, potentially bypassing transaction security checks.
- Some stores display the real brand's support address, sending victims to the impersonated company.
- Nebty launched a searchable database to help brands detect DoppelCart impersonation and abuse.
- Vendors
- Nebty
- Threat actors
- DoppelCart
- Victims
- BogusBazaar
- Organizations
- NebtyDoppelCart
From the original article
2 min read at bleepingcomputer.com
A massive operation dubbed "DoppelCart" uses more than 119,000 domains to run a network of fake e-shops that steal payment card details. [...]
By Bill Toulas · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.