DoppelCart operation uses over 119,000 fake domains to steal payment card details

A massive operation named DoppelCart has been discovered, utilizing over 119,000 domains to create a network of fake e-commerce shops designed to steal payment card details. This operation significantly surpasses previously documented fake-shop clusters in scale, based on information published by Bleeping Computer.

The DoppelCart operation, identified by cybersecurity startup Nebty, operates an extensive network of fake online stores, with over 105,000 sites still active. These sites impersonate legitimate businesses by copying product catalogs, branding, and images, often directly from the original companies' servers. They mimic approximately 44,182 different brands, with some brands being targeted by over 30 fake shops. To lure unsuspecting customers, the fake sites advertise significant discounts, sometimes up to 65%.

During checkout, malicious code collects sensitive payment card information, including card numbers, expiration dates, security codes, cardholder names, email addresses, phone numbers, and physical addresses. This data is transmitted in real-time to the attackers' command-and-control servers. The code can also capture one-time bank confirmation codes, potentially bypassing security measures. Nebty has created a searchable database to help companies identify and address DoppelCart impersonations.

Source: Bleeping Computer