InfoHawk Uncovers 820 Restaurant Impersonation Domains Running Payment-Skimming Campaigns

Discovery of Widespread Impersonation

InfoHawk researchers uncovered a network of 820 suspicious restaurant domains, primarily using the .delivery top-level domain, impersonating 35 major US restaurant chains. These include well-known brands such as Jersey Mike's, Jimmy John's, Firehouse Subs, Chipotle, and Dave's Hot Chicken. The investigation began in early November 2026 after identifying a suspicious domain mimicking Jersey Mike's.

Sophisticated Skimming Techniques

The attackers are not using simple fake websites. Instead, they employ reverse-proxying, which allows them to display genuine content and ordering flows from the legitimate restaurant sites. This method makes the fraudulent sites appear nearly identical to the official ones, making them highly convincing to customers. The malicious element is injected at the checkout stage, where a modified payment form is presented.

Data Captured and Risks

The sophisticated payment-skimming attacks capture credit card information from unsuspecting customers. Additionally, the malicious checkout forms ask customers for SMS verification codes sent by their banks. This combination is particularly dangerous, as obtaining both credit card details and a one-time verification code could enable attackers to authorize fraudulent transactions, depending on the bank's security protocols.

Impact on Consumers

For consumers, the experience of ordering from these fraudulent sites can be almost indistinguishable from using the official restaurant websites. The familiar appearance, menu, and ordering process contribute to the deception. This campaign highlights a growing threat in online food delivery, where criminals exploit trust and familiarity to steal sensitive financial information.