DoppelCart fraud network uses 119,000 fake shops to steal credit cards
DoppelCart fraud network uses 119,000 fake shops to steal credit cards.
A massive operation named DoppelCart has been discovered, utilizing over 119,000 fake e-commerce domains, primarily in the .SHOP TLD, to steal credit card details. These sites impersonate legitimate brands with significant discounts to lure victims, collecting sensitive payment information and even one-time bank confirmation codes.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Nebty?
Get an email when a new story names Nebty, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe DoppelCart operation demonstrates how threat actors can deploy massive, automated fraud infrastructure to impersonate legitimate brands and harvest payment card data at scale. Victims are lured by unrealistically deep discounts and convincing brand imitation, leading them to willingly submit credit card numbers and even one-time authentication codes. This matters because once OTP codes are captured, even multi-factor authentication protections tied to payment accounts are effectively bypassed. The sheer volume of 119,000 domains illustrates how low the barrier to entry has become for large-scale phishing and fraud campaigns. Organizations and consumers alike must treat unfamiliar e-commerce sites — especially those on lesser-known TLDs like .SHOP — with heightened scrutiny.
What helps against this
How we list vendors- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
- DNS filtering and secure web gateway
Users cannot reach known-malicious sites, and malware cannot phone home.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.