DoppelCart 119,000-domain fake-shop fraud campaign
Campaign
Summary
Hide ▲
Show ▼
The DoppelCart operation now spans 119,000+ domains, running fake e-shops that steal payment card details and expose shoppers to real-time fraud. More than 105,000 shops remain active, extending the reach of the cluster across the .SHOP ecosystem. The sites mimic legitimate brands and relay checkout data and bank one-time codes to the operators' C2. The scale and persistence make it a broad, ongoing consumer-fraud campaign.
Timeline
-
08.09.2026 23:35 2 articles · 13h ago
Nebty uncovers DoppelCart fake-shop fraud network
Initial DisclosureNebty identified DoppelCart as a fake-shop fraud network spanning more than 119,000 domains, with more than 105,000 shops still active. The cluster imitates 44,182 brands and uses checkout code that collects payment card numbers, expiration dates, security codes, cardholder names, email addresses, phone numbers, physical addresses, and bank one-time confirmation codes before relaying them over WebSockets to C2 in real time.
Show sources
- DoppelCart fraud network uses 119,000 fake shops to steal credit cards — www.bleepingcomputer.com — 08.09.2026 23:35
- DoppelCart fraud network uses 119,000 fake shops to steal credit cards — www.bleepingcomputer.com — 08.09.2026 23:35