Darcula
Darcula is a phishing-as-a-service (PhaaS) platform used in large-scale smishing and phishing campaigns. Reporting describes it as a prominent Chinese-language phishing operation, also referred to as Magic Cat in some tracking, and links it to a broader China-based smishing ecosystem associated with the activity cluster known as Smishing Triad. PRODAFT attributes the kit to threat actor LARVA-246 and reports it is advertised via the Telegram channel "xxhcvv / darcula_channel." Darcula has been observed using Apple iMessage, RCS, Google Messages, and other messaging platforms to distribute phishing lures, often impersonating postal services such as USPS, and Google previously assessed Darcula or Magic Cat as accounting for 80% of phishing texts in the United States.
Darcula provides automated phishing page generation and website cloning capabilities. It can generate phishing pages from a supplied legitimate URL with matching HTML and CSS layouts, and later updates allowed customers to clone any brand’s legitimate website to create a phishing version. In 2025, operators added generative AI features that enable creation of customized, multi-language phishing forms, including form generation, field customization, and translation into local languages without coding skills. Google’s reporting on the related ecosystem also describes AI-assisted workflows in which generated code can be converted into fully functioning scam websites, lowering the barrier for low-skill operators.
The platform is associated with financially motivated credential theft and payment fraud. Supporting reporting states that phishing pages seek credit card data, account credentials, one-time passcodes, and other personal information; some campaigns use fake MFA pages and real-time operator interaction to capture authentication codes and bypass multifactor authentication. Stolen payment information has been used to provision cards into digital wallets for unauthorized purchases, and compromised brokerage credentials have been used in stock-manipulation-related fraud. Darcula is described as globally targeting individuals through mobile-focused phishing, with lures localized across languages and regions.
Infrastructure and scale indicators directly mentioned in the content include Netcraft’s disruption metrics since March 2024: more than 25,000 Darcula pages taken down, nearly 31,000 associated IP addresses blocked, and over 90,000 phishing domains flagged. Additional reporting tied to the broader operation states that more than 1.59 million malicious URLs were detected over a five-month period and that millions of phishing messages were observed on Google Messages. Darcula also reportedly shares identical features and templates with another PhaaS platform called Lucid, and Netcraft assesses Darcula, Lucid, and Lighthouse as part of a loosely connected cybercrime ecosystem.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The threat actors behind the Darcula phishing-as-a-service (PhaaS) platform have released new updates to their cybercrime suite with generative artificial intelligence (GenAI) capabilities.
The threat actors behind the Darcula phishing-as-a-service (PhaaS) platform have released new updates to their cybercrime suite with generative artificial intelligence (GenAI) capabilities.
Techniques & procedures
4 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique
Initial Access
Execution
1 technique
Execution
Stealth
1 technique
Stealth
Credential Access
1 technique
Credential Access
IOCs tracked for this family
5 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Recent activity
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A prominent phishing operation associated with large-scale phishing text campaigns in the United States.
A Chinese-language phishing-as-a-service platform that uses automated page generation to clone legitimate websites, supporting scalable phishing and real-time credential/token interception campaigns.
Phishing-as-a-service platform that leverages generative AI to create convincing, multi-language phishing pages, primarily delivered via iMessage and RCS for smishing campaigns.
Darcula is a phishing-as-a-service platform that enables users to easily generate sophisticated phishing pages, now enhanced with generative AI for multilingual and customizable attacks.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.