Restaurant Delivery Payment-Skimming Campaign

InfoHawk researchers identified 820 suspicious domains impersonating 35 major U.S. restaurant brands, including Jersey Mike’s, Jimmy John’s, Firehouse Subs, Chipotle, and Dave’s Hot Chicken. The domains were found in two research passes in early November 2026; 808 use the .delivery ending, with the remainder using .com or .shop. Jimmy John’s was the most heavily targeted brand, with 404 domains. Many names are misspellings designed to resemble legitimate restaurant addresses, while the sites reproduce familiar menus, branding, and ordering flows.

The central threat is a payment-skimming method that can make these sites especially convincing: attackers use a reverse proxy to display content from a real restaurant website on infrastructure they control, then replace its checkout form with a fraudulent one. Customers may enter their card details and the one-time SMS verification code sent by their bank. Captured card data can enable theft, and a verification code may help criminals authorize transactions, depending on the bank’s security process. Because the authentic site is being copied rather than modified, the restaurant itself does not need to have been hacked. The familiar appearance and normal ordering experience can conceal the fraud until payment, when customers are asked to provide sensitive information.