DoppelCart Network Uses 119,000 Fake Shops to Steal Payment Card Data
Summary
Nebty says DoppelCart spans over 119,000 fake-shop domains, with more than 105,000 still active. Its cloned storefronts impersonate 44,182 brands and capture payment details and other personal data at checkout.
Key points
- Nebty describes DoppelCart as the largest publicly documented fake-shop cluster by domain count; more than 105,000 of its 119,000-plus shops are reportedly still active.
- The shops impersonate 44,182 brands using copied catalogs, descriptions, branding, and images.
- Nebty says 96% of confirmed shops share identical build files and resolve to 27 commerce backends.
- Tested checkout pages collected card details and personal information, transmitting the data to command-and-control servers over WebSockets.
- Checkout code can also relay bank-issued one-time confirmation codes, which attackers may use to bypass security protections.
- Nebty created a searchable database to help companies identify DoppelCart impersonation and brand abuse.
Article Details
- Event Type
- Discovery of a large-scale fake e-shop and payment-card theft operation.
- Impact
- DoppelCart uses cloned storefronts to steal payment-card details and other personal information, transmitting the data to command-and-control servers in real time. The checkout code can also relay bank-issued one-time confirmation codes. Nebty reports more than 119,000 domains, over 105,000 shops still active, and impersonation of 44,182 brands.