Darcula

Darcula is a Chinese-language phishing-as-a-service platform associated with large-scale smishing and mobile-focused phishing operations. It is used to create and operate spoofed websites that impersonate trusted brands and services in order to steal credentials, payment card data, one-time passcodes, and other personal information. Reporting links the platform to a broader financially motivated smishing ecosystem sometimes referred to as Smishing Triad, and some research attributes the kit to the threat actor LARVA-246. Darcula has been promoted through Telegram-based criminal channels and has been observed in campaigns impersonating postal and road-toll services, among other brands.

Darcula is notable for lowering the barrier to entry for phishing operators. It provides automated page generation and site-cloning capabilities that can reproduce the appearance of legitimate websites from a supplied URL, including matching layout elements. In 2025, the platform added generative AI features that support multilingual phishing page creation, phishing form generation, field customization, and translation into local languages, enabling less technically skilled actors to rapidly build customized lures.

The platform has been associated with delivery through Apple iMessage, RCS, and SMS-style smishing workflows. Its campaigns are designed for broad consumer targeting and financial fraud, with emphasis on mobile users. Within the wider Chinese-language PhaaS ecosystem, operations using platforms such as Darcula increasingly support real-time interception of authentication data and session-oriented fraud rather than simple static password theft alone. Darcula has also been cited as part of the broader trend of AI-enabled phishing kits that increase the scale, localization, and plausibility of phishing attacks globally.