Darcula phishing kit

The platform keeps the visitor connected live

Netcraft introduced the name Darcula in 2024 for a phishing-as-a-service platform used in delivery and payment messages. Mnemonic's examination of its operator system showed how values typed into a page reach the operator live.

The public delivery flow begins with a small fee, then asks for an address, payment card and bank verification. The Darcula bundle in our captures uses parking charges instead. It moves through vehicle or invoice details, card and phone fields, then a localized one-time-code page. These are different lures built on the same style of operator-controlled payment flow.

The code page waits for the operator

The captured bundle keeps the current card details and route state in local storage. On the verification page it displays the card ending and amount, then sends the code through an event named submit_card. Input can also be reported while the visitor types.

The connection is designed to survive interruptions. It sends heartbeats, queues messages until they are acknowledged, reconnects with increasing delays and can fall back to HTTP. An operator response can reject the code, return the visitor to the form or leave the page ready for another attempt. This live exchange explains why a visitor can receive a specific error after submitting a plausible code.

The early and later bundles we captured used different parking brands and languages, and their compiled files were different. The storage fields, card-submission event and socket behaviour stayed recognizable across the rebuilds.

The root page can conceal the flow

Netcraft found Darcula deployments that showed a holding page at the hostname root while the phishing flow lived under a specific path. Bots could be redirected elsewhere. Mnemonic also found pages limited to mobile devices or cellular connections. A check of the bare hostname from a desktop network can therefore miss the useful page.

Netcraft's later analysis of Darcula v3 described a generator that separates the lure, address, card and two-factor-code steps and applies path, device, IP and crawler filters. The local bundle gives defenders a code-level signature that persists even when the lure and language change.

What we see

Month	New sites
September	11
October so far	0

The latest Darcula match in this snapshot was 22 September. 6 sites matched in the last 30 days.

Finding the live-controlled payment bundle

Start with the complete reported URL and preserve the compiled JavaScript. Search for stored card, phone, vehicle or invoice fields, an OTP route, input_card and submit_card events, heartbeat and acknowledgement handling, a reconnect queue and HTTP fallback. Exercise the page only with test values and record how an operator response changes the verification screen.