Skip to navigation

Threat reportThreat IntelligenceTL-2026-5171

Wuffy AI Toy Dog Scam Network: 250+ Fake Storefronts Laundering Proceeds Through Shell Companies (Huntress Declassified: Money Train, Episode Four)

mediumACTIVE

Huntress and Mastercard describe a cybercrime-enabled retail fraud network operating 250+ near-identical storefronts that sell a cheap battery-operated plush toy as an 'AI' robot dog (Wuffy) at $30, marked down from $100. Mastercard attributed roughly $50 million in transactions to merchant IDs tied to the operation; the merchant of record was a Lithuania-based company while the sites showed a US address. First disclosed .

Key facts for Wuffy AI toy dog scam

IdentifiersTL-2026-5171
Also known asWuffy scam, Get Wuffy, Money Train Episode Four
SeverityMEDIUM
First disclosed
Exploitation statusExploited in the wild
Affected productsConsumers / payment card holders Online card payments to fake AI-toy storefronts; Card issuers and acquirers Merchant onboarding and chargeback/dispute handling
MalwareDachy 2.0, FluffyBot Puppy, Koaly Bear
MITRE ATT&CK techniquesT1036 Masquerading, T1583.001 Domains, T1583.006 Web Services, T1583.008 Malvertising, T1657 Financial Theft, T1684.001 Impersonation
MotivationFINANCIAL
Target sectorsconsumer, retail, finance
Target regionsNorth America, Europe
Detection rules9 (1 shown free)
Sources10 cited sources

Detection coverage for Wuffy AI toy dog scam

As of 2026-11-03, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5171 across Splunk SPL, Microsoft KQL and Sigma, covering 13 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Wuffy Fake Storefront Access via Web Proxy — Checkout Reach

Flags web proxy requests to known Wuffy fake AI robot-dog storefront domains (getwuffy.com, wuffy.nl, wuffy.uk, gowuffy.checkoutera.com) and escalates when cart/checkout/payment URLs are hit, indicating a card-entry attempt on a scam storefront (TL-2026-5171). Behaviour-first: grouped per source and user so a checkout stage is separated from a passive visit.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1583.001, T1656, T1036
  • Data sources: proxy:zscalernss-web, proxy:bluecoat:proxysg:access:syslog
  • Severity: medium
  • Confidence: high

Splunk SPL

index=proxy (sourcetype="zscalernss-web" OR sourcetype="bluecoat:proxysg:access:syslog") earliest=-24h
(dest IN ("getwuffy.com","wuffy.nl","wuffy.uk","gowuffy.checkoutera.com","www.getwuffy.com","www.wuffy.nl","www.wuffy.uk") OR url="*getwuffy.com*" OR url="*gowuffy.checkoutera.com*" OR url="*wuffy.nl*" OR url="*wuffy.uk*")
| eval checkout_hit=if(match(url,"(?i)checkout|cart|payment"),1,0)
| stats count AS requests, sum(checkout_hit) AS checkout_requests, min(_time) AS firstTime, max(_time) AS lastTime, values(dest) AS storefront_hosts, values(http_referrer) AS referrers BY src, user
| eval stage=if(checkout_requests>0,"checkout_reached_possible_card_entry","storefront_visit")
| eval firstTime=strftime(firstTime,"%Y-%m-%d %H:%M:%S"), lastTime=strftime(lastTime,"%Y-%m-%d %H:%M:%S")
| eval threat_id="TL-2026-5171"
| table threat_id src user stage requests checkout_requests storefront_hosts referrers firstTime lastTime

Microsoft KQL

CommonSecurityLog
| where TimeGenerated > ago(24h)
| where isnotempty(RequestURL)
| where DestinationHostName in~ ("getwuffy.com", "wuffy.nl", "wuffy.uk", "gowuffy.checkoutera.com") or RequestURL has_any ("getwuffy.com", "wuffy.nl", "wuffy.uk", "gowuffy.checkoutera.com")
| extend CheckoutHit = iff(RequestURL matches regex @"(?i)checkout|cart|payment", 1, 0)
| summarize Requests = count(), CheckoutRequests = sum(CheckoutHit), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), StorefrontHosts = make_set(DestinationHostName, 10) by SourceIP, SourceUserName
| extend Stage = iff(CheckoutRequests > 0, "checkout_reached_possible_card_entry", "storefront_visit")
| project SourceIP, SourceUserName, Stage, Requests, CheckoutRequests, StorefrontHosts, FirstSeen, LastSeen

Sigma

title: Web Proxy Access to Wuffy Fake AI-Toy Storefronts
id: 5b1c0a7e-3f2d-4a8e-9c11-7d4e2a6b1001
status: experimental
description: Detects web proxy traffic to domains of the Wuffy fake AI robot-dog storefront network reported by Huntress and Mastercard (getwuffy.com, wuffy.nl, wuffy.uk, gowuffy.checkoutera.com).
references:
    - https://www.huntress.com/blog/declassified-money-train-episode-four
    - https://www.mastercard.com/europe/en/news-and-trends/stories/2026/scam-merchant-wuffy.html
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-03
tags:
    - attack.resource-development
    - attack.t1583.001
    - attack.defense-evasion
    - attack.t1656
logsource:
    category: proxy
detection:
    selection:
        cs-host|endswith:
            - 'getwuffy.com'
            - 'wuffy.nl'
            - 'wuffy.uk'
            - 'gowuffy.checkoutera.com'
    condition: selection
fields:
    - c-ip
    - cs-username
    - cs-host
    - c-uri
    - cs-referrer
falsepositives:
    - Consumers or analysts researching the scam (security teams, fraud investigators)
    - Threat-intel sandbox or URL-scanner traffic
level: medium

Known false positives:

  • Fraud analysts or security staff investigating the Wuffy scam
  • URL-scanner or sandbox traffic that fetches the storefronts

Tuning notes: Fields (dest, url, http_referrer, src, user) assume CIM-normalised Zscaler/Blue Coat web logs; adjust index/sourcetype to your proxy. Exclude analyst subnets and alert only where stage=checkout_reached_possible_card_entry to cut noise. Re-verify domains against the original Huntress post, since the source extraction was summarised.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Endpoint Browser Connection to Wuffy Fake Storefront Domains · unlock with TL Creds
  • Auto-Added Multi-Unit Low-Ticket Orders at Suspect Merchant · unlock with TL Creds
  • Community-Reported Malvertising Sibling Infrastructure — DNS Lookup and Installer Download · unlock with TL Creds
  • DNS Resolution of Wuffy Storefront and Checkoutera Checkout Domains · unlock with TL Creds
  • Transactions With UAB Rara Digital Merchant Entity · unlock with TL Creds
  • Wuffy Template-Clone and Sister-Brand Storefront Domain Lexical Hunt · unlock with TL Creds
  • Spoofed Merchant Identity — Merchant-of-Record vs Storefront Address Mismatch Cluster · unlock with TL Creds
  • Malvertising Referral Chain to Wuffy Storefronts · unlock with TL Creds

Indicators of compromise for Wuffy AI toy dog scam

As of 2026-11-03, Threadlinqs Intelligence tracks 13 indicators of compromise for TL-2026-5171.

Sample indicators (3 of 13)

  • Domain: getwuffy[.]com
  • Domain: wuffy[.]nl
  • Domain: gowuffy[.]checkoutera[.]com

Defanged, TLP:CLEAR. Full set of 13 indicators: unlock with TL Creds.

13 indicators of compromise · unlock with TL Creds. Compare plans

How Wuffy AI toy dog scam works

The Wuffy scam is a bulk fake-storefront operation. Per Huntress (Declassified: Money Train, Episode Four, published 2026-11-03), more than 250 near-identical websites sold an 'AI' toy dog at a $30 price presented as a 70% discount from a fictitious $100 regular price. The product that arrives is a battery-operated stuffed/mechanical toy with no AI functionality. The sites displayed a consistent 4.7-star rating and offered responsive customer support to appear legitimate.

Mastercard cyber investigators, tipped off about the scam site, ordered a unit from Get Wuffy (getwuffy.com) and found the payment record named a company headquartered in Lithuania while the website listed a US address. Mastercard's analysis of its own network found about $50 million in transactions associated with merchant IDs identified in the investigation, and noted the true scale was likely larger. Public reporting (BBB Scam Tracker, via search results) associates the merchant entity UAB Rara Digital, Gedimino pr. 20, Vilnius, Lithuania, with the Get Wuffy storefront. Victim reports describe carts that auto-add multiple units (billed for three or four dogs), countdown timers that reset on refresh, pre-selected bundles/upsells, AI-generated or stock-photo reviewer profiles, and returns requiring shipment to China at the buyer's expense. MalwareTips (2026-04-07) lists sister brands built from the same template: Dachy 2.0, Koaly Bear, FluffyBot Puppy; other reports mention Waggy and Digital Doggo.

The low unit price is a deliberate fraud-economics choice: small charges discourage chargebacks and fraud investigations, and when disputes occur the issuing bank absorbs the loss (Mastercard's Ann Johnson: 'When a store turns out to be a scam, the bank covers the loss. Scammers rarely have to pay any of it back, and they know it.'). Proceeds are routed through shell companies. Huntress describes the network as Lithuania-based with connections to Russian nationals and organized crime networks, and frames it alongside the UK NCA's Operation Destabilise, which traced ransomware proceeds through Garantex, crypto-for-cash swaps with UK drug gangs, and Russian-state-linked laundering, and which resulted in six convictions according to the Huntress write-up. The Huntress article draws the thematic link to money-laundering infrastructure; it does not publish a technical IOC set for the Wuffy sites, and attribution to specific individuals is not made in the sources.

Defender relevance: this is a payments-fraud and brand-abuse threat rather than an exploit chain. Useful controls are merchant-of-record vs. site-address mismatch checks, monitoring for look-alike storefront clusters and malvertising (YouTube/social ads for the product), and consumer/employee awareness. Source detail was gathered from a summarized extraction of the Huntress post, so specifics should be re-verified against the original.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1036 Masquerading; T1684.001 Impersonation

Resource Development

T1583.001 Domains; T1583.006 Web Services; T1583.008 Malvertising

Impact

T1657 Financial Theft

Remediation for Wuffy AI toy dog scam

Immediate actions

  • Block or flag getwuffy.com, wuffy.nl and gowuffy.checkoutera.com at web/DNS filtering and secure email gateways
  • Consumers who purchased: dispute the charge with the card issuer and request a replacement card; check the card statement for duplicate or multi-unit charges
  • Issuers/acquirers: review merchant IDs where the merchant-of-record country (Lithuania) differs from the storefront's stated address (US)

Workarounds

  • Verify bank and vendor contact details independently; use the contact number on the back of the payment card
  • Prefer virtual or single-use card numbers for unfamiliar online merchants

Longer-term hardening

  • Acquirers: strengthen merchant onboarding and transaction-laundering monitoring for clusters of near-identical storefronts sharing one merchant entity
  • Run scam-awareness communication for staff and families about 'too good to be true' discounts on AI gadgets
  • Monitor for new sister-brand storefronts reusing the same template (e.g. Dachy 2.0, Koaly Bear, FluffyBot Puppy)

Affected and fixed versions

  • Consumers / payment card holders — Online card payments to fake AI-toy storefronts
    Vulnerable versions: N/A
  • Card issuers and acquirers — Merchant onboarding and chargeback/dispute handling
    Vulnerable versions: N/A

Timeline of Wuffy AI toy dog scam

  • UK NCA publicly details Operation Destabilise (reported December 2024; exact day not stated in sources), tracing ransomware proceeds through locked-ioc-13, crypto-for-cash swaps with UK drug gangs and Russian-linked laundering; later referenced by Huntress as context for the Wuffy money trail
  • UK NCA publishes an Operation Destabilise update naming the locked-ioc-7 (locked-ioc-2) and locked-ioc-8 (George Rossi) laundering networks, locked-ioc-6 and A7; reports 128 arrests since inception and over GBP 25 million seized in the UK, with cash-to-crypto swaps as the core method
  • BBB Scam Tracker and Trustpilot victim reports about Get Wuffy begin appearing (December 2025 and January 2026 per search results; day is approximate)
  • Further BBB Scam Tracker victim reports about Get Wuffy (January 2026 per search results; day is approximate): multi-unit carts, resetting timers, returns to China at buyer's expense
  • MalwareTips publishes an investigation of Wuffy, documenting fake urgency timers, fake reviews, upsells, and sister brands locked-ioc-10, locked-ioc-9 and locked-ioc-4
  • Huntress publishes Declassified: Money Train Episode Four describing 250+ near-identical storefronts, ~$50 million annual transactions, shell-company laundering and Russia-linked organized crime connections; recounts Mastercard's investigation (undated in retrievable sources: test purchase from locked-ioc-5 showed Lithuania merchant of record vs US site address) and the CNA Financial ransomware laundering case traced by Operation Destabilise

Sources cited for Wuffy AI toy dog scam

Drafted by the Threadlinqs research pipeline from 10 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats