Darcula is a "phishing

as a service " as a service" (rendered as *aaS in acronyms) is a phrasal template for any business model in which a product use is offered as a subscription-based service rather than as an artifact owned and maintained by the customer. The converse of conduc ...

" (PhaaS) Chinese-language platform which has been used in

phishing Phishing is a form of social engineering and a scam where attackers deceive people into revealing sensitive information or installing malware such as viruses, worms, adware, or ransomware. Phishing attacks have become increasingly sophisticate ...

attacks against organizations (government, airlines) and services (postal, financial) in over 100 countries. Darcula offers to cybercriminals more than 20,000 counterfeit domains (to spoof brands) and over 200 templates. Darcula uses

iMessage iMessage is an instant messaging service developed by Apple Inc. and launched in 2011. iMessage functions exclusively on Apple platforms – including iOS, iPadOS, macOS, watchOS, and visionOS – as part of Apple ecosystem, Apple's approach t ...

and RCS (

Rich Communication Services Rich Communication Services (RCS) is a communication protocol standard for instant messaging, primarily for mobile phones, developed and defined by the GSM Association (GSMA). It aims to be a replacement of SMS and Multimedia Messaging Service, ...

) to steal credentials from Android and iPhone users. In May 2025, the Norwegian Broadcasting Corporation (NRK) in collaboration with BR,

Le Monde (; ) is a mass media in France, French daily afternoon list of newspapers in France, newspaper. It is the main publication of Le Monde Group and reported an average print circulation, circulation of 480,000 copies per issue in 2022, including ...

, and the Norwegian cybersecurity company

mnemonic A mnemonic device ( ), memory trick or memory device is any learning technique that aids information retention or retrieval in the human memory, often by associating the information with something that is easier to remember. It makes use of e ...

reported on Darcula. They reported that the group was able to steal a total of 884,000 credit cards from victims during a period of seven months between 2023 and 2024. They also claim that the software used by the group, Magic Cat, was developed by Yucheng C., a 24-year old man from Henan, China.

References

Cybercrime Mobile malware {{improve categories, date=November 2024