In early November 2026, Info Hawk researchers uncovered a coordinated payment-skimming campaign using 820 fraudulent domains to impersonate 35 restaurant brands. The operation primarily exploits the .delivery top-level domain, with 808 domains using it, alongside a few .com and .shop variants. Attackers reverse-proxy legitimate restaurant websites, displaying authentic content while replacing checkout forms with malicious ones.
This technique allows fraudsters to collect credit card details and SMS verification codes without hacking the original restaurant sites. The investigation began with a suspicious domain impersonating Jersey Mike’s, which reproduced the real site’s ordering flow but substituted a fraudulent payment form. Victims may not realize they’re on a fake site, as the interface appears identical to the genuine one.
The campaign highlights how cybercriminals leverage familiarity and trust in food delivery platforms to execute large-scale identity and payment theft. Brands like Jimmy John’s were heavily targeted, with over 400 cloned domains registered between March and October 2026.
Source: Hacker News · Summarized by HeadlinesBriefing