A recent discovery: A new, advanced phishing platform as a service

According to researchers at Netcraft, a new phishing-as-a-service platform called darcula has been discovered. This platform, operating on over 20,000 phishing domains, provides cybercriminals with access to phishing templates and simplifies the deployment of phishing sites.

Unlike other similar platforms, darcula has the ability to update in place, allowing for the incorporation of new features and anti-detection measures. For example, researchers noted an update where the kit was modified to conceal the attack’s location.

Research findings revealed that darcula infrastructure domains were present on 11,000 IP addresses spread across more than 100 countries. Since the start of 2024, an average of 120 domains have hosted phishing pages daily. The phishing attacks have specifically targeted USPS, DHL, Evri, as well as postal services in Bulgaria, Australia, and Singapore. Darcula focuses on industries that rely on consumer trust, such as postal services, financial institutions, government agencies, and telecommunications firms.