Full Report
A massive operation dubbed "DoppelCart" uses more than 119,000 domains to run a network of fake e-shops that steal payment card details. [...]
Analysis Summary
# Incident Report: Operation DoppelCart Fraud Network
## Executive Summary
DoppelCart is a massive, ongoing fraud operation utilizing a network of over 119,000 domains to host fake e-commerce shops. The operation impersonates over 44,000 legitimate brands to harvest payment card details and personal identifiable information (PII) from unsuspecting consumers. Using sophisticated real-time data exfiltration via WebSockets, the attackers bypass security measures, including one-time passwords (OTP).
## Incident Details
- **Discovery Date:** September 8, 2026 (Public Disclosure)
- **Incident Date:** Active and ongoing as of late 2026
- **Affected Organization:** 44,182 different brands impersonated
- **Sector:** Retail / E-commerce
- **Geography:** Global (targeting online shoppers)
## Timeline of Events
### Initial Access
- **Date/Time:** Ongoing
- **Vector:** Deceptive Advertising / SEO / Brand Impersonation
- **Details:** Attackers register thousands of domains (primarily using the .SHOP TLD) that mimic legitimate brands. They lure victims through extreme discounts (up to 65%) and high-quality clones of product catalogs and branding.
### Lateral Movement
- **Details:** N/A (The attack focuses on external consumer deception rather than internal network penetration of the brands themselves).
### Data Exfiltration/Impact
- **Details:** As victims enter checkout information, the sites capture card numbers, CVVs, expiration dates, names, emails, phone numbers, and physical addresses. This data is transmitted in real-time to attacker-controlled command-and-control (C2) servers.
### Detection & Response
- **Detection:** Discovered by German cybersecurity startup Nebty through large-scale scans and cluster analysis.
- **Response:** Nebty published a searchable database for brands to identify clones; attempts to contact hosting providers were made but initially went unanswered.
## Attack Methodology
- **Initial Access:** Fraudulent web domains/Brand impersonation.
- **Persistence:** High-volume domain registration (119,000+ domains) to ensure infrastructure survival despite individual takedowns.
- **Defense Evasion:** Use of identical build files across 27 commerce backends to scale efficiently; hosting assets directly from legitimate brand servers to increase perceived authenticity.
- **Credential Access:** Payment card skimming via fraudulent checkout forms.
- **Collection:** Automated collection of PII and credit card data via web forms.
- **Exfiltration:** Use of **WebSockets** for real-time transmission of stolen data to C2 servers.
- **Impact:** Financial fraud and identity theft; bypass of MFA/OTP by relaying bank confirmation codes in real-time.
## Impact Assessment
- **Financial:** High potential for consumer loss; significant impact on legitimate brands due to lost sales and chargeback inquiries.
- **Data Breach:** Massive theft of credit card data and PII.
- **Operational:** Brands are forced to handle customer support for orders placed on fake sites.
- **Reputational:** Damage to brand trust when customers are scammed by sites using the brand's logos and images.
## Indicators of Compromise
- **Network Indicators:**
- High volume of domains on `.shop` TLD (specifically 2.72% of all .shop domains).
- Traffic to 27 specific commerce backends (IPs not disclosed in brief).
- WebSocket connections to unauthorized C2 domains during the checkout process.
- **Behavioral Indicators:**
- E-shops offering uniform 65% discounts across various unrelated brands.
- Sites copying CSS/Images directly from legitimate source URLs (Hotlinking).
## Response Actions
- **Containment:** Nebty released a searchable database for brands to identify and report clones.
- **Eradication:** Ongoing attempts to coordinate with hosting providers to shut down the 105,000+ currently active sites.
- **Recovery:** Public awareness campaigns to alert consumers to the "DoppelCart" cluster characteristics.
## Lessons Learned
- **Infrastructure Scaling:** Attackers are now capable of managing hundreds of thousands of domains simultaneously, indicating high levels of automation.
- **Real-time Exploitation:** The use of WebSockets allows attackers to intercept OTPs, rendering some traditional 3D Secure (3DS) protections vulnerable to "man-in-the-middle" style automation.
- **TLD Risks:** The .SHOP TLD is being heavily abused for fraud, requiring stricter monitoring by registrars.
## Recommendations
- **For Brands:** Proactively monitor the `.shop` TLD for domain registrations containing your brand name. Implement "Content Security Policy" (CSP) headers to prevent your assets from being hotlinked or scripts from communicating with unauthorized C2s.
- **For Consumers:** Verify URLs carefully; if a site offers deep discounts (60%+) across its entire catalog, it is likely fraudulent. Use virtual credit cards with spending limits for new or unfamiliar shops.
- **For Registrars:** Implement more rigorous vetting or "Know Your Customer" (KYC) protocols for bulk domain registrations on e-commerce-centric TLDs.