DoppelCart is a large-scale fraud operation using more than 119,000 domains, mostly under the .SHOP TLD, to run fake online stores that steal payment card data. Discovered by German cybersecurity startup Nebty, the network mimics over 44,000 brands with cloned shops that share identical build files and resolve to a limited set of commerce backends. The fake shops collect detailed payment card information and personal data during checkout, transmitting it via WebSockets to attacker-controlled command-and-control servers. Some shops also capture one-time bank confirmation codes, potentially bypassing additional security measures. Despite attempts to contact hosting providers, no takedown response was received. Nebty provides a database to assist brands in detecting DoppelCart impersonations and mitigating brand abuse.

The DoppelCart network enables attackers to steal comprehensive payment card details and personal information from victims through fake e-commerce shops. This can lead to fraudulent transactions, financial loss, and identity theft. The ability to capture one-time bank confirmation codes increases the risk of bypassing security protections such as two-factor authentication. The large scale and persistence of the network, with over 105,000 active fake shops, amplify the potential impact on consumers and legitimate brands whose identities are impersonated.

No official fix or takedown has been confirmed as the main hosting provider did not respond to contact attempts. Organizations affected by DoppelCart impersonation should use the searchable database provided by Nebty to identify fraudulent sites and take appropriate actions such as reporting to domain registrars and hosting providers, issuing public warnings, and monitoring for brand abuse. Consumers should be advised to verify the legitimacy of e-commerce sites before making purchases and to be cautious of unusually large discounts. Patch status is not applicable as this is a fraud network rather than a software vulnerability.