GoKawiilFake restaurant delivery sites steal card data and bank SMS codes
InfoHawk researchers identified 820 malicious domains impersonating 35 restaurant brands, most using the .delivery top-level domain, designed to mimic online food-ordering sites. The scheme reverse-proxies genuine restaurant websites but swaps in a fraudulent checkout form that collects credit card numbers and SMS verification codes sent by banks.