Darcula phishing kit
Darcula is a phishing-as-a-service platform. We have matched one of its live-controlled payment bundles on 16 sites since 21 August.
Darcula in numbers
Since 21 August, the first Darcula match in our records, counted on 12 November 2026. How we count.
| Sites with Darcula code | 16 |
|---|---|
| Sites with a match in the last 30 days | 1 |
| New sites in October | 1 |
| Last match | 13 October |
The platform keeps the visitor connected live
Netcraft introduced the name Darcula in 2024 for a phishing-as-a-service platform used in delivery and payment messages. Mnemonic's examination of its operator system showed how values typed into a page reach the operator live.
The public delivery flow begins with a small fee, then asks for an address, payment card and bank verification. The Darcula bundle in our captures uses parking charges instead. It moves through vehicle or invoice details, card and phone fields, then a localized one-time-code page.
The code page waits for the operator
The captured bundle keeps the current card details and route state in local storage. On the verification page it displays the card ending and amount, then sends the code through an event named submit_card. Input can also be reported while the visitor types.
It sends heartbeats, queues messages until they are acknowledged, reconnects with increasing delays and can fall back to HTTP. An operator response can reject the code, return the visitor to the form or leave the page ready for another attempt.
The early and later bundles we captured used different parking brands and languages, and their compiled files were different. The storage fields, card-submission event and socket behaviour stayed recognizable across the rebuilds.
The root page can conceal the flow
Netcraft found Darcula deployments that showed a holding page at the hostname root while the phishing flow lived under a specific path. Bots could be redirected elsewhere. Mnemonic also found pages limited to mobile devices or cellular connections. A check of the bare hostname from a desktop network can therefore miss the useful page.
Netcraft's later analysis of Darcula v3 described a generator that separates the lure, address, card and two-factor-code steps and applies path, device, IP and crawler filters.
What we see
| Month | New sites |
|---|---|
| September | 11 |
| October | 1 |
| November so far | 0 |
The latest Darcula match was 13 October. 1 site matched in the last 30 days.
Finding the live-controlled payment bundle
Start with the complete reported URL and preserve the compiled JavaScript. Search for stored card, phone, vehicle or invoice fields, an OTP route, input_card and submit_card events, heartbeat and acknowledgement handling, a reconnect queue and HTTP fallback. Exercise the page only with test values and record how an operator response changes the verification screen.