GoKawiilFake restaurant delivery sites steal card data and bank SMS codes
InfoHawk researchers identified 820 malicious domains impersonating 35 restaurant brands, most using the .delivery top-level domain, designed to mimic online food-ordering sites. The scheme reverse-proxies genuine restaurant websites but swaps in a fraudulent checkout form that collects credit card numbers and SMS verification codes sent by banks.
GoKawiil's interpretation of the reporting above, not reported fact.
Because the sites display real restaurant content while only altering the payment page, they could be far harder for consumers to spot than typical phishing clones. Capturing both card data and one-time SMS codes suggests attackers may be trying to bypass bank fraud protections, though actual success would depend on each bank's verification process.
- 820 fraudulent domains impersonate 35 restaurant brands, mostly on .delivery domains
- Attackers use reverse-proxying to show real site content while swapping the checkout form
- Stolen data includes credit card numbers and SMS bank verification codes
Yubico YubiKey 5C NFC Security Key — With fake restaurant ordering sites cloning real brands to skim payment info, strengthening your account security habits matters more than ever. A hardware security key like the YubiKey adds a phishing-resistant layer of protection for your email, password manager, and payment accounts, so even if a skimming site captures credentials, attackers can't easily get in. It's a simple, durable way to harden your digital life against these kinds of impersonation scams.
See Yubico YubiKey 5C NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: infohawk.com, 2026-11-06
Published there as: “Restaurant Delivery Payment-Skimming Campaign”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.