NewsMV
A fake-shopping operation called DoppelCart has been linked by cybersecurity firm Nebty to roughly 119,000 domains.
The sites impersonate legitimate businesses and can steal payment details at checkout, including one-time bank verification codes.
More than 105,000 of those stores were active in Nebty's latest scans, and the company says the majority of the cluster remains online. The operation's scale sets it apart from prior documented networks.
Nebty CEO Benedikt Scheungraber told BleepingComputer that 96% of confirmed DoppelCart shops shared identical build files and resolved to 27 commerce backends, pointing to a shared technical foundation across the cluster.
Keep reading