Technology1 min read

Restaurant Delivery Payment-Skimming Campaign

By · Published by Everything Blog

In short

A massive phishing operation was discovered by InfoHawk researchers after identifying 820 domains mimicking 35 major American dining chains. The malicious infrastructure deploys reverse proxies that display genuine ordering menus while quietly replacing legitimate checkout workflows with credential-harvesting mechanisms. Beyond standard card numbers, the fraudulent forms harvest bank-issued SMS verification codes to authorize illicit purchases. Notably, Jimmy John's was heavily targeted, representing nearly half of the deceptive web properties discovered.

Key points

  • Reverse proxy infrastructure allows threat actors to display authentic menus without comp…: Reverse proxy infrastructure allows threat actors to display authentic menus without compromising legitimate restaurant servers.
  • Fraudulent checkout portals bypass payment security by capturing both credit card numbers…: Fraudulent checkout portals bypass payment security by capturing both credit card numbers and bank-issued SMS codes.
  • Diners using lookalike domains face severe financial risks from unauthorized transactions…: Diners using lookalike domains face severe financial risks from unauthorized transactions enabled by the intercepted authentication credentials.

Sources checked by our analysis pipeline: 1

Scamwich: Inside a Restaurant Delivery Payment-Skimming Campaign

InfoHawk research has uncovered a network of 820 suspicious restaurant domains impersonating major US chains, including Jersey Mike's, Jimmy John's, Firehouse Subs, Chipotle, and Dave's Hot Chicken. Some are running sophisticated payment-skimming attacks that capture credit card information and ask customers for their bank's SMS verification codes.

When customers order food online, they expect a familiar experience: find

their restaurant, choose their meal, and pay. Increasingly, criminals are

exploiting that familiarity by creating convincing clones of restaurant

ordering websites, right down to the original site's underlying code.

In early November 2026, InfoHawk researchers investigated a collection of

suspicious websites that appear to be part of one or more coordinated

restaurant impersonation and payment-skimming operations.

Across two research passes, we identified 820 domains impersonating 35

restaurant brands. Of those, 808 use the .delivery top-level

domain, and the rest use .com or .shop.

The scale is concerning, but what makes these sites particularly dangerous

is how convincing they can be.

These aren't ordinary fake websites

The investigation began with a suspicious domain:

mlckessejersstey[.]delivery.

The site…

Technology

More in Technology