- About 600 threat players use Darcula, experts warn
- They have managed to steal more than 800,000 credit card information in less than one year
- Mobile devices are the main targets of phishing today
Darcula, a notorious phishing-as-a-service (phaas) kit, has helped hundreds of its users steal nearly a million credit card about half a year, cybersecurity scientists have said.
Analysts from NRK, Bayerischer Rundfunk, Le Monde and the Norwegian security company Mnemonic have drilled deep into Darcula, which in just seven months between 2023 and 2024 earned about 600 operators.
The hackers were able to generate 13 million clicks on malicious links that were sent via text messages to targets all over the world – and were, as a result, capable of stealing 884,000 credit cards.
Generative AI threats
Apparently, Darcula is focused on mobile platforms – Android and iOS, using 20,000 domains and can easily be falsified by known brands.
It stands out from other similar platforms by using RCS and iMessage instead of the usual SMS, making its attacks more effective.
To make things worse, Darcula allows its users to automatically generate phishing sets for almost any conceivable brand, convert credit cards to virtual cards and using generative artificial intelligence (Genai) they can create phishing messages in almost any language and on almost any topic.
Darcula’s operators appear to be Chinese origin as most communication is performed in closed telegram groups and in Chinese language. The researchers also observed SIM yard and hardware setups that allow operators to offer mass text messages and credit card treatment through terminals.
A September 2024 report from security scientists Zimperium argued four out of five (82%) of all phishing places today target mobile devices, as they are generally weaker and more often not administered compared to desktop and laptops.
However, defending against phishing has not changed much. It is still about common sense and is skeptical of all incoming messages, especially those with a sense of urgency or unexpected attachment.
Clicking Links IE emails and SMS messages, especially those hidden behind a placeholder or a URL shortening, are also risky.
Via Bleeping computer
