Scamwich: Inside a Restaurant Delivery Payment-Skimming Campaign — InfoHawk News

InfoHawk researchers identified 820 domains impersonating 35 restaurant brands in a coordinated payment-skimming campaign, with 808 of the sites registered under the .delivery top-level domain and the remainder using .com or .shop. The operation, flagged in early November 2026 after investigators examined a suspicious Jersey Mike's clone at mlckessejersstey[.]delivery, uses reverse-proxying to serve genuine restaurant pages while swapping in a fraudulent checkout form that harvests credit card details and bank SMS verification codes. Because the legitimate restaurant sites are never compromised, the clones can appear nearly indistinguishable from the real ordering experience at the exact moment customers pay. The campaign matters because it targets the checkout step directly, and capturing one-time verification codes could let attackers push through fraudulent transactions depending on how a victim's bank applies them. What to watch next is whether the domain count keeps climbing across further research passes and whether restaurants or payment providers move to flag the .delivery namespace.