A massive cybercrime operation, dubbed “DoppelCart,” has been uncovered by German cybersecurity startup Nebty. The network uses a staggering 119,000 fake online shops to steal sensitive information from unsuspecting consumers’ payment cards. What’s more alarming is that most of these fake sites are still active, with over 105,000 sites still up and running.
The DoppelCart operation is remarkable for its sheer scale and sophistication. Nebty’s CEO Benedikt Scheungraber describes it as the largest publicly documented fake-shop cluster by domain count, far surpassing previous notable operations like “BogusBazaar.” The fake shops in question impersonate legitimate businesses by copying product catalogs, descriptions, branding, and images from the real companies’ servers. In some cases, the sites even use identical build files, resolving to 27 commerce backends.
The DoppelCart network is designed to lure bargain-hunting shoppers with attractive discounts of up to 65% off popular brands like SodaStream, Velasca, and Daniel Wellington. Once a victim enters their payment information on one of these fake checkout pages, sensitive data such as card numbers, expiration dates, security codes, and even personal details are transmitted in real-time to the attackers’ command-and-control center.
What’s more disturbing is that some of the fake stores may display legitimate support addresses from the impersonated brands. This can lead victims who didn’t receive their purchases to contact the real company, inadvertently helping the attackers stay under the radar. Nebty’s attempts to reach out to the hosting provider for DoppelCart sites were met with silence.
The DoppelCart operation highlights the need for consumers and businesses alike to be vigilant when making online transactions. It’s essential to verify the authenticity of a website before entering sensitive information, especially during peak shopping seasons like holidays or special sales events. Companies must also stay proactive in monitoring their brand presence online and take swift action against any suspicious activity.
To help companies protect themselves, Nebty has created a searchable database to identify DoppelCart impersonation and brand abuse. It’s crucial for businesses to be aware of these tactics and implement robust security measures to prevent similar attacks in the future.
Ultimately, the success of operations like DoppelCart underscores the importance of cybersecurity awareness and education among consumers and organizations alike. By staying informed and taking proactive steps to protect ourselves online, we can reduce our vulnerability to such sophisticated cybercrime schemes.
Source: Bleeping Computer — 2026-09-08