Actor Profile

DoppelCart is a large-scale fraud operation attributed to coordinated threat actors conducting payment card theft through fraudulent e-commerce infrastructure. The operation leverages over 119,000 fake domains to impersonate legitimate online storefronts, targeting consumers across e-commerce, retail, and financial services sectors. The actor's motivation is financially driven, focused on harvesting payment card data from unsuspecting victims who attempt to make purchases on counterfeit websites. The scale and coordination of the domain infrastructure suggests a well-resourced operation with significant technical capability in domain registration, hosting, and web development to maintain thousands of convincing fake storefronts.

TTPs (Tactics, Techniques, Procedures)

The DoppelCart operation primarily employs social engineering and phishing techniques to lure victims to fraudulent e-commerce sites. Key TTPs likely include: T1566 (Phishing) for initial victim engagement through malicious advertisements or search engine optimization; T1583.001 (Acquire Infrastructure: Domains) demonstrated by the registration of 119,000+ domains; T1589 (Gather Victim Identity Information) and T1590 (Gather Victim Network Information) through fake checkout processes; T1056.003 (Input Capture: Web Portal Capture) to harvest payment card details entered on fraudulent payment forms; and T1583.006 (Acquire Infrastructure: Web Services) to host the fake storefronts. The operation represents a sophisticated use of infrastructure acquisition and social engineering at scale.

Targets & Patterns

DoppelCart targets individual consumers who shop online, with secondary impact on organizations in the e-commerce, retail, and financial services sectors. The operation exploits consumer trust in online shopping platforms by creating convincing fake storefronts that mimic legitimate retailers. Victims are likely reached through search engine results, malicious advertising, or phishing campaigns that direct them to fraudulent domains. The broad targeting approach suggests the actors are not focused on specific geographic regions or demographics, but rather cast a wide net to maximize victim volume. The scale of 119,000+ domains indicates an attempt to evade detection and takedown efforts while maintaining persistent access to potential victims across multiple brand impersonations and product categories.

Historical Context

The DoppelCart campaign represents an evolution in the scale and sophistication of e-commerce fraud operations. While fake online storefronts and payment card skimming have been persistent threats in the cybercrime landscape, the coordination of over 119,000 domains under a single operation is notable for its magnitude. This campaign follows patterns seen in previous large-scale phishing and credential harvesting operations that leverage domain generation and bulk registration techniques. The operation shares tactical similarities with Magecart-style attacks, though DoppelCart focuses on entirely fraudulent storefronts rather than compromising legitimate e-commerce sites. The scale suggests potential connections to organized cybercrime infrastructure providers or bulletproof hosting services that enable such widespread domain abuse.

Defensive Recommendations

  • Monitor for newly registered domains mimicking legitimate brand names and implement domain monitoring services to detect typosquatting and brand abuse patterns associated with fake e-commerce sites
  • Educate consumers and employees on identifying fraudulent e-commerce sites by checking for HTTPS certificates, verifying domain legitimacy, reviewing seller reputation, and being suspicious of deals that seem too good to be true
  • Implement network-level blocking of known DoppelCart domains and leverage threat intelligence feeds that track fraudulent e-commerce infrastructure to prevent user access to fake storefronts
  • Deploy web filtering solutions that can detect and block access to suspicious newly registered domains (NRDs) and sites with characteristics common to fraudulent e-commerce operations
  • For financial institutions: enhance payment card fraud detection systems to identify patterns associated with purchases from fraudulent domains and implement real-time transaction monitoring for suspicious merchant activity