A sprawling online scam has defrauded hundreds of thousands of consumers worldwide by hijacking legitimate shopping websites, redirecting buyers to fake online stores, and collecting payments for products that were never delivered, cybersecurity experts reported this week.

The scheme, tracked by cybersecurity research group Satori Threat Intelligence, cleverly used malicious code to create fake product listings on compromised shopping sites. These bogus listings appeared in search engine results for high-demand, hard-to-find items, enticing buyers into scams. When unsuspecting shoppers clicked on these listings, they were sent to fraudulent websites where payment information was collected, but goods were never shipped.

In a statement, Satori described how the hackers targeted items with limited availability, such as retro-themed goods, including oven mitts styled after the Nintendo Power Glove. The scammers listed these niche products for around $60, making them seem like legitimate offers to the unwary consumer.

The scheme, dubbed “Phish ‘n’ Ships,” has been active since at least 2019, and its operators used Simplified Chinese in their backend systems, suggesting a potential link to Chinese cyber actors. Satori has since informed payment processors and law enforcement, leading to significant disruption of the operation. Despite this, the researchers warn that the scammers may still be active and looking for new tactics.

In total, “Phish ‘n’ Ships” is estimated to have caused tens of millions of dollars in losses, affecting over a thousand compromised websites and establishing 121 fake stores, Satori reports.