Loading story…
Researchers identified DoppelCart, a network of roughly 118,787–119,000 fraudulent online-shop domains, predominantly under the .shop top-level domain, impersonating more than 44,000 brands. The storefronts copy legitimate product catalogs, images, descriptions, and branding—at times publishing a victim company’s real support address—causing reputational damage and redirecting customer-service complaints to the impersonated business. The shops lure buyers with discounts of up to 65%, and most of the identified network remains online despite some takedowns.
DoppelCart checkout pages capture billing and payment-card details, including CVVs and potentially bank one-time authentication codes, then exfiltrate them to attacker-controlled infrastructure over WebSockets in real time. Investigators linked the sites through recurring infrastructure and site-building traits: 96% of confirmed shops shared identical build files and the cluster used 27 e-commerce backends. The attribution reflects shared technical characteristics rather than proof that a single identified actor operates every domain; researchers have published a searchable database to help organizations find impersonating stores.
Get the infrastructure and lures behind it.
1 event from the most recent confirmed update back to the earliest known activity.
Nebty published an investigation identifying DoppelCart, a cluster of approximately 119,000 .shop domains impersonating more than 44,000 brands, described as the largest publicly documented fake-shop network by associated-domain count. The cloned stores reused legitimate retail content and captured payment-card, billing, and potentially bank authentication-code data through checkout pages that transmitted data to attacker-controlled servers; Nebty also published a searchable database for affected businesses.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
9 references tracked. Mallory keeps watching after this page renders.
xakep.ru
Open sourcecyberveille.ch
Open sourcecysecurity.news
Open sourcemalware.news
Open sourcemalwarebytes.com
Open sourcenebty-id.com
Open sourcenebty-id.com
Open sourcenetcraft.com
Open sourcethehackernews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Recent research has uncovered the technical infrastructure supporting underground carding markets, identifying 28 unique IP addresses and 85 domains actively hosting illegal platforms for trading stolen credit card data. These marketplaces function as sophisticated e-commerce sites, with criminals selling payment card information for prices ranging from $5 to $150 per card, depending on credit limits and associated identity details. Investigators used internet-wide scanning techniques, focusing on HTTP and HTTPS title banners, to detect servers advertising carding-related keywords before they could be hidden behind services like Cloudflare. The analysis revealed that these operations frequently use top-level domains such as .su, .cc, and .ru, exploiting their loose registration policies and jurisdictional challenges to maintain operational security. The research, conducted between July and December 2025, provided law enforcement with actionable intelligence, including login pages and forum landing pages for carding sites, which can support subpoenas and takedown efforts. The findings also highlighted the variety of methods used to steal credit card data, including web skimming attacks, database breaches, and physical skimming devices at ATMs and point-of-sale terminals. The exposure of these technical details offers critical insights into the infrastructure and operational patterns of carding markets, enabling more effective disruption of these criminal enterprises.
Jun 29, 2026
Group-IB reported that the **FakeSecurity** JavaScript sniffer was used in a large Magecart-style campaign targeting Magento-based e-commerce sites, where malicious code was implanted into checkout pages to steal customers' payment card data. The activity was tied to attacker-controlled domains including `alloaypparel.com` and `firstofbanks.com`, along with compromised websites used to host payloads and lure pages. Investigators linked the skimming operation to an earlier malware campaign aimed at likely e-commerce administrators, in which spam emails and fake document-viewer landing pages delivered the **Vidar** password stealer through the **Mephistophilus** phishing kit. Group-IB said the apparent goal was to harvest administrator credentials, gain access to Magento and other e-commerce CMS panels, and then deploy the skimmer; infrastructure overlap with earlier **LokiBot** and **AZORult** activity suggests the same cybercrime group ran multiple credential-theft operations to support the card-skimming attacks.
Aug 14, 2026
Researchers found a compromised **X-Cart** e-commerce site running two separate payment skimmers: a basic server-side stealer and a more advanced client-side JavaScript skimmer. The server-side malware captured base64-encoded payment `POST` data and saved it to a fake `.jpg` file, while the browser-based skimmer validated that a credit card number was present before exfiltrating checkout data to attacker infrastructure. Analysts traced the X-Cart exfiltration path to `metahtmlhead[.]com/folder/ip/zxc.php`, with the destination assembled through DOM-based domain construction to hinder detection. The JavaScript skimmer used layered obfuscation and an anti-debugging technique tied to wrapper-function length, forcing researchers to brute-force parts of the code to recover its behavior. A similar skimmer was later identified on a **Magento 1.x** site, using the same obfuscation style and a matching URL path structure but sending stolen payment data to `winsiott[.]com/folder/ip/stt.php`. The overlap in code design, evasion methods, and infrastructure indicates a broader web-skimming campaign targeting multiple e-commerce platforms.
Aug 15, 2026