More than 100,000 fake stores are out to steal your card details
Researchers uncovered DoppelCart, a network of roughly 119,000 cloned fake shops that harvest card details and one-time bank codes during checkout.
Researchers at German firm Nebty identified 118,787 .shop domains tied to cloned online stores, representing 2.72% of the TLD population examined and described as the largest publicly documented fake-shop network by domain count. The shops mimic more than 44,000 brands, advertise discounts up to 65%, and 96% of confirmed shops reportedly share identical build files using just 27 ecommerce backends. Fraudulent checkout pages send card numbers, CVVs, billing data and bank one-time confirmation codes to attacker-controlled servers in real time over WebSockets, allowing criminals to complete payments while victims are still checking out.
- Largest documented fake-shop network by associated domain count
- Clones catalogs, branding and images from more than 44,000 brands
- Real-time WebSocket capture of one-time codes enables fraudulent payments
- Some brands such as SodaStream and Daniel Wellington have 30+ clones each
- Threat actors
- DoppelCart
- Countries
- Germany
From the original article
2 min read at malwarebytes.com
DoppelCart’s fake stores copy real retailers and steal shoppers’ card details and one-time bank confirmation codes.
By @MetallicaMVP · malwarebytes.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.