[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fE1V_GZIWLvqqjlO_DnN8_3pP3cUk7fLU_wmmd5f24nk":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":49,"controls":50},"552f353c-1e17-46da-bf48-65d49103caf7","doppelcarts-119000-fake-shops-highlight-consumer-fraud-risks","467d7f31-b426-4220-87d2-8424b7d15528","DoppelCart's 119,000 Fake Shops Highlight Consumer Fraud Risks","The DoppelCart operation demonstrates how threat actors can deploy massive, automated fraud infrastructure to impersonate legitimate brands and harvest payment card data at scale. Victims are lured by unrealistically deep discounts and convincing brand imitation, leading them to willingly submit credit card numbers and even one-time authentication codes. This matters because once OTP codes are captured, even multi-factor authentication protections tied to payment accounts are effectively bypassed. The sheer volume of 119,000 domains illustrates how low the barrier to entry has become for large-scale phishing and fraud campaigns. Organizations and consumers alike must treat unfamiliar e-commerce sites — especially those on lesser-known TLDs like .SHOP — with heightened scrutiny.","**Immediate actions:**\n- Verify any unfamiliar e-commerce site's legitimacy by cross-checking the official brand domain before entering payment details.\n- Never share one-time bank confirmation codes on a website prompted during an online shopping session, as legitimate retailers do not request them directly.\n- Use virtual or single-use credit card numbers when shopping on unfamiliar online stores.\n\n**Long-term improvements:**\n- Implement browser-based or endpoint security tools that flag newly registered, suspicious, or lookalike domains before users interact with them.\n- Organizations should actively monitor for domain impersonation of their brand using threat intelligence services and submit takedown requests promptly.\n- Train employees and customers regularly on social engineering tactics, including fake discount lures and brand impersonation schemes.\n\n**Detection measures:**\n- Deploy DNS filtering solutions that block access to known malicious or newly registered domains in high-risk TLDs like .SHOP.\n- Monitor threat intelligence feeds for bulk domain registrations that mimic your organization's brand identity.\n- Establish alerting for mentions of your brand on fraudulent domains using digital risk protection platforms.",[12,13,14,15,16,17,18,19,20,21],"CIS Control 9 – Email and Web Browser Protections","CIS Control 14 – Security Awareness and Skills Training","CIS Control 17 – Incident Response Management","NIST SP 800-53 SI-8 – Spam Protection","NIST SP 800-53 AT-2 – Literacy Training and Awareness","NIST SP 800-53 SC-7 – Boundary Protection","GDPR Article 32 – Security of Processing (for merchants handling payment data)","PCI DSS Requirement 6.4 – Protection of Public-Facing Web Applications","PCI DSS Requirement 12.6 – Security Awareness Program","NIST CSF PR.AT-1 – Awareness and Training",{},"published","2026-09-08T22:21:40.001275+00:00","2026-09-08T22:21:39.896+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fdoppelcart-fraud-network-uses-119-000-fake-shops-to-steal-credit-cards\u002F","doppelcart-fraud-network-uses-119-000-fake-shops-to-steal-credit-cards-44a5bf","DoppelCart fraud network uses 119,000 fake shops to steal credit cards",[31,37,43],{"id":32,"name":33,"slug":34,"description":35,"color":36},"1732a005-556e-411c-a9db-5edec3058571","Logging & Monitoring","logging-monitoring","Missing logs, no alerting, blind spots","#a855f7",{"id":38,"name":39,"slug":40,"description":41,"color":42},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":44,"name":45,"slug":46,"description":47,"color":48},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[51,55,59],{"slug":52,"name":53,"problem":54},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",{"slug":56,"name":57,"problem":58},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",{"slug":60,"name":61,"problem":62},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes."]