Darcula

Darcula is a Chinese-language phishing-as-a-service platform used primarily for large-scale smishing and mobile-focused phishing operations. It is associated with financially motivated campaigns that impersonate postal, delivery, government, retail, financial, and other trusted brands to steal payment-card data, credentials, personal information, and in some cases multifactor authentication codes. Reporting has linked the platform to the threat actor designation LARVA-246 and to a broader loosely connected smishing ecosystem often referred to as Smishing Triad.

Darcula is notable for industrialized phishing operations rather than a conventional malware payload. The platform supports operator dashboards, template distribution, licensing and activation management, real-time victim interaction, and live streaming of submitted data to backend administration panels. Observed capabilities include collecting victim-entered information in real time, prompting victims for additional verification data such as PINs or one-time codes, and integrating with messaging workflows used to distribute lures at scale. The kit has also used anti-analysis and anti-forensics measures, including selectively serving phishing content only to targeted mobile devices on cellular networks.

Delivery has centered on smishing through SMS, Apple iMessage, and RCS, with lures commonly claiming a package issue, toll problem, or similar urgent account matter. Darcula has been used to impersonate postal and delivery services and has also been described as capable of rapidly cloning legitimate websites. Later updates added generative AI features that allow operators to generate, customize, and translate phishing forms in multiple languages with minimal technical skill, further lowering the barrier to entry for cybercriminals and improving localization at scale.

The platform targets mobile users globally and has been tied to high-volume phishing activity, particularly in the United States and other international markets. Stolen data has been used for financial fraud, including unauthorized digital-wallet provisioning of compromised payment cards. Darcula exemplifies the maturation of phishing infrastructure into a commercial service model that combines scalable lure delivery, real-time operator support, and increasingly automated page generation.