Restaurant Delivery Payment-Skimming Campaign

InfoHawk researchers report 820 look-alike domains impersonating 35 restaurant chains, 808 of them on .delivery, with Jimmy John's, Firehouse Subs and Jersey Mike's most cloned. The sites reverse-proxy the real ordering pages and swap in a checkout that collects card details and the bank's SMS code, so no restaurant site needs to be breached. The figures come from InfoHawk's own two research passes, with no independent source given. For teams running ordering or payment flows, it shows why typosquat monitoring and one-time-code phishing defenses matter.