Loading malware…
Darcula is a commercial phishing-as-a-service platform used for large-scale, financially motivated phishing and smishing campaigns against individuals worldwide. Its ecosystem includes phishing software known as Magic Cat. Campaigns distribute messages through SMS, Apple iMessage, and Rich Communication Services (RCS), commonly impersonating postal services, package-delivery companies, and road-toll services. Typical lures claim that a delivery requires corrected address information or payment of a small fee, directing victims to counterfeit websites that collect personal information and payment-card details.
The platform provides brand-impersonation templates, license and activation management, SMS gateway integration, and an operator dashboard. Victim-entered information is streamed to operators in real time through Socket.IO messaging, and operators can interact with victims to request additional PIN codes. Observed implementations encrypt application messages using the Rabbit algorithm and restrict access according to mobile-device and cellular-network checks, returning error responses to visitors that fail those checks. These controls hinder automated inspection and analysis.
Darcula supports automated cloning of legitimate websites and, following updates announced in April 2025, generative-AI-assisted phishing form creation, field customization, and multilingual translation. These features allow operators with limited programming knowledge to produce localized phishing sites quickly. Development has been attributed to the threat actor LARVA-246. Darcula operates within a loosely connected Chinese-language cybercrime ecosystem associated with the Smishing Triad activity cluster; it is a phishing toolkit and service rather than an endpoint malware family.
2 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Since 2025, Road Toll Smishing infrastructure has evolved to use a phish kit called Darcula.
The threat actors behind the Darcula phishing-as-a-service (PhaaS) platform have released new updates to their cybercrime suite with generative artificial intelligence (GenAI) capabilities.
12 distinct techniques documented for this family, organized by ATT&CK tactic.
Information that CoGUI collects as part of its victim profiling includes: GeoIP (geographical location of IP address) Language configuration of the browser Browser type (e.g. Chrome) Browser version Monitor screen height and width OS Platform (e.g. win32) If the victim’s browser is running on a mobile device
These pages collect payment-card details or online-banking credentials.
Top 10 Phishing Kits and Platforms
“CTM360 tracks a coordinated wave of SMS-based phishing campaigns, PointyPhish and TollShark… using urgent messages to trick victims into submitting personal and financial information via fake landing pages.”
The platform replaced static templates with AI-powered page generators and browser automation tools such as Puppeteer. “This enables users to clone legitimate websites by replicating their HTML, CSS, JavaScript, and visual elements using a target website URL.”
Analysis of the pages uncovered persistent WebSocket connections that transmitted victims’ personal information, payment-card details, and one-time passwords to attacker-controlled servers as they were entered.
This technique presents a simulated browser window and address bar inside the phishing page, making the authentication prompt appear to originate from a legitimate Microsoft domain.
Analysis of the pages uncovered persistent WebSocket connections that transmitted victims’ personal information, payment-card details, and one-time passwords to attacker-controlled servers as they were entered.
Before serving the phishing page, CoGUI profiles the victim’s browser. Victim profiling is used for targeting purposes but may also serve to evade automated analysis sandboxes.
“These scams impersonate trusted brands, from banks to toll authorities.”
The emails contained URLs leading to a credential capture webpage impersonating Raktuen, which was designed to collect user credentials.
“[SMS messages] trick victims into submitting personal and financial information via fake landing pages” and the Darcula panel enabled operators to “log victim data in real time.”
Within this ecosystem, GTIG has observed a fundamental move away from static password harvesting towards real-time interception and tokenization.
Before serving the phishing page, CoGUI profiles the victim’s browser. Victim profiling is used for targeting purposes but may also serve to evade automated analysis sandboxes.
The emails contained URLs leading to a credential capture webpage impersonating Raktuen, which was designed to collect user credentials.
“[SMS messages] trick victims into submitting personal and financial information via fake landing pages” and the Darcula panel enabled operators to “log victim data in real time.”
Within this ecosystem, GTIG has observed a fundamental move away from static password harvesting towards real-time interception and tokenization.
Analysis of the pages uncovered persistent WebSocket connections that transmitted victims’ personal information, payment-card details, and one-time passwords to attacker-controlled servers as they were entered.
64 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.