Cybercriminals Deploy Over 119,000 Fake Online Stores in DoppelCart Card‑Theft Scheme

Security researchers have identified a sprawling fraud operation known as "DoppelCart" that runs more than 119,000 domain names masquerading as legitimate e‑shops to harvest payment‑card information from unsuspecting shoppers.

The scheme works by creating convincing storefronts that imitate popular retailers or niche boutiques. When a victim adds items to the cart and proceeds to checkout, the site silently captures the credit‑card number, expiration date and security code before forwarding the shopper to the real merchant’s site, making the theft difficult to detect.

Investigators say the sheer volume of domains gives the network a high degree of resilience; even if a handful of sites are shut down, thousands more can continue operating. The fake shops appear to target consumers worldwide, exploiting the rapid growth of online shopping and the trust users place in familiar brand‑like URLs.

Following the initial disclosure by BleepingComputer, cybersecurity firms and law‑enforcement agencies have begun coordinated takedown efforts, contacting domain registrars and hosting providers to suspend the malicious sites. Alerts have also been issued to financial institutions, urging card issuers to monitor for unusual transaction patterns linked to the identified domains.

Experts warn that the DoppelCart model is likely to evolve, with attackers adapting to security measures and leveraging new registration tactics. Consumers are advised to verify URLs carefully, use virtual card numbers when available, and monitor statements for unauthorized charges. Continued collaboration between the private sector and authorities will be essential to dismantle the network and protect the growing number of online shoppers.