In a sophisticated evolution of cybercrime, a Chinese-language phishing-as-a-service platform known as "Darcula" has emerged as a dominant force, unleashing a wave of phishing attacks across more than 100 countries. With over 19,000 phishing domains in its arsenal, Darcula offers cybercriminals easy access to branded phishing campaigns for a subscription fee of approximately $250 per month, according to researchers at Netcraft.
Unlike traditional phishing operations, Darcula employs advanced techniques, utilizing tools commonly found in application development such as JavaScript, React, Docker, and Harbor. Additionally, it leverages iMessage and RCS (Rich Communication Services) for text message-based scams, enabling messages to bypass SMS firewalls, a tactic previously unseen in phishing attacks.
Targeting consumers rather than businesses, Darcula's phishing campaigns often masquerade as package delivery notifications from well-known postal services like Kuwait Post, Etisalat, Jordan Post, Saudi Post, Australia Post, Singapore Post, and others. These scams, deployed via text messages or smishing, aim to deceive recipients into divulging sensitive information or financial details by directing them to fraudulent websites.
The operation came under scrutiny when Israeli security researcher Oshri Kalfon uncovered the Darcula platform after receiving a scam message in Hebrew. Further investigation revealed the platform's vulnerabilities, including easily hackable admin panels due to default login credentials left unchanged by scammers.
Darcula's modus operandi includes hosting phishing websites on purpose-built domains rather than hacking legitimate ones, a strategy aimed at evading detection. These websites frequently abuse Cloudflare and other hosting services, with the majority utilizing .top and .com domains.
Since the beginning of 2024, Netcraft has identified an alarming average of 120 new domains hosting Darcula phishing pages daily, indicating the widespread reach and impact of the operation. Robert Duncan, Vice President of Product Strategy at Netcraft, describes Darcula as the most pervasive worldwide package scam operation the company has encountered.
Defence against Darcula and similar phishing schemes involves vigilant behaviour such as avoiding clicking on links in unsolicited messages and directly accessing purported sources' websites. Enterprises are advised to employ commercial security platforms to block access to known phishing sites, providing a crucial layer of protection against evolving cyber threats.
Despite ongoing efforts to combat phishing, Darcula's sophisticated tactics and expansive reach underscore the need for continued vigilance and proactive security measures in the face of evolving cyber threats.
