Restaurant Delivery Payment-Skimming Campaign

InfoHawk researchers discovered a network of 820 fraudulent domains impersonating major US restaurant chains like Chipotle, Jersey Mike's, and Jimmy John's, primarily using the .delivery top-level domain. These sophisticated sites use reverse-proxy technology to display authentic restaurant pages while secretly replacing checkout forms with malicious ones that steal credit card information and SMS verification codes from customers. The scam is particularly dangerous because the fraudulent websites appear nearly identical to legitimate restaurant ordering sites, making it difficult for consumers to detect the fraud.