Threat reportPhishingTL-2026-3372
Darcula V3 Phishing Kit: On-Demand Brand Cloning via darcula-suite
Darcula V3 Phishing Kit (TL-2026-3372), also tracked as Darcula V3, is a high-severity phishing campaign, first published 2026-10-12. It has no confirmed attribution, affects Multiple (brand-agnostic) Consumer-facing brands, postal services and, maps to 10 MITRE ATT&CK techniques (T1056.003, T1111, T1204.001), and is covered by 9 detection rules and 14 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 10MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 14Indicators of compromise
Key facts for TL-2026-3372
- Threat ID
- TL-2026-3372
- Also known as
- Darcula V3, darcula-suite 3.0, Darcula PhaaS v3
- Severity
- HIGH
- Status
- ACTIVE
- Category
- PHISHING
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- finance, postal and logistics, government administration, telecoms, retail, aviation
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 14
Malware and tooling in Darcula V3 Phishing Kit
Malware and tooling: Darcula, RCS, darcula-suite, telegram, Headless Chrome, Puppeteer
How Darcula V3 Phishing Kit works
Darcula V3 is a phishing-as-a-service kit whose darcula-suite component uses browser automation to clone any brand's website into a phishing page from a supplied URL, replacing fixed templates. Campaigns are delivered by smishing (SMS, iMessage, RCS) and harvest payment card details, personal information and verification codes through multi-step flows.
Darcula is a phishing-as-a-service (PhaaS) platform first exposed by Netcraft in March 2024. Version 2 shipped roughly 200 pre-built templates covering postal services, financial institutions, government bodies, airlines and telecommunications providers across 100+ countries. Darcula V3, announced by the developer on Telegram on 19 January 2025, delayed on 10 February 2025 and observed in mid-February 2025, introduces darcula-suite, a tool that removes the fixed-template limit.
The operator supplies a brand URL in a web interface. Headless Chrome driven by Puppeteer-style browser automation captures the HTML and all required assets. The operator then selects HTML elements to replace and injects phishing content such as payment forms and login fields, styled to match the brand. Front-end production takes about 10 minutes. The suite produces multi-page flows (lure, address, card details, 2FA/verification code) and exports them as a .cat-page bundle that is uploaded to an admin panel. Doppel describes the suite as automating four operations: website capture, form modification for data collection, deployment packaging, and campaign administration through operator dashboards.
Netcraft observed Docker-based deployment. Images are pulled from registry.magic-cat.world (v3/web and v3/api) using an installer at v3.magic-cat.world/install.sh. The stack uses React admin dashboards, a Node.js backend and an SQLite database. Telegram is used for command and notification channels, including victim confirmations. The developer channel had over 1,200 subscribers. Chinese-language announcements and machine-translated interfaces point to Chinese-origin criminal operators; no named actor attribution is made in the sources.
Victims are lured by smishing over SMS, iMessage and RCS, typically impersonating postal services and financial institutions. Stolen card details are used to generate card images for provisioning into digital wallets on burner phones. Netcraft reports devices pre-loaded with up to 20 stolen cards circulating in adjacent Telegram communities. An April 2025 update added generative AI for form generation, translation and page customization (per Doppel).
Evasion measures include randomized deployment URL paths per campaign, filtering of visitors by IP address, crawler behavior and device type (blocking non-mobile analysis tools), conditional content serving, and client-side React rendering that requires JavaScript execution. Hosting is commonly on purpose-registered domains, with compromised websites as a secondary option. Netcraft reports more than 95,000 Darcula phishing domains and about 31,000 IP addresses detected and over 20,000 sites taken down since March 2024. Doppel reports removing more than 20,000 Darcula-related sites over roughly ten months. Neither source lists victim-facing phishing domains or named targeted brands for V3. Severity is analyst-assigned; no CVE or CVSS applies.
MITRE ATT&CK techniques used in TL-2026-3372
Credential Access
T1056.003 Web Portal Capture; T1111 Multi-Factor Authentication Interception
Execution
Defense Evasion
T1480 Execution Guardrails; T1684.001 Impersonation
Initial Access
Resource Development
T1583.001 Domains; T1608.005 Link Target
Reconnaissance
Impact
Affected products and versions in Darcula V3 Phishing Kit
- Multiple (brand-agnostic) — Consumer-facing brands, postal services and financial institutions impersonated by Darcula
Vulnerable versions: Not applicable - social engineering
Remediation for Darcula V3 Phishing Kit
Immediate actions
- Block and sinkhole magic-cat.world, v3.magic-cat.world and registry.magic-cat.world at DNS and proxy where legitimate use is not expected
- Preserve full URL chains, original SMS/iMessage/RCS messages and screenshots for takedown and reporting
- Report phishing URLs to the impersonated brand and the hosting provider and coordinate takedowns, monitoring for re-hosting
Workarounds
- Enable SMS filtering and carrier spam reporting for smishing
- Require out-of-band confirmation in digital wallet provisioning flows for new cards
Longer-term hardening
- Train users to verify requests through official channels independently rather than via links in messages
- Validate suspected impersonation pages against the brand's authentic workflow
- Map related assets across infrastructure (domains, IPs, hosting) and monitor for newly registered lookalike domains
- Enforce phishing-resistant authentication so one-time codes harvested by the kit cannot be replayed
Timeline of Darcula V3 Phishing Kit
- Netcraft first exposes the Darcula phishing-as-a-service platform (late March 2024); V2 offers about 200 brand templates across 100+ countries.
- Darcula developer announces V3 and darcula-suite on Telegram.
- Netcraft begins monitoring container image pull counts for the darcula-suite V3 Docker registry (monitoring period 5-10 February 2025).
- Developer status update on Telegram indicates the V3 release is delayed.
- Netcraft publishes technical analysis of darcula-suite 3.0, including the Docker registry and .cat-page export; more than 95,000 Darcula domains, about 31,000 IPs and over 20,000 takedowns since March 2024.
- The Hacker News reports Darcula PhaaS v3 and its ability to clone any brand in minutes and generate wallet card images from stolen data.
- April 2025 update adds generative AI for form generation, translation and page customization (day approximate; source states month only).
Sources cited for Darcula V3 Phishing Kit
- Darcula V3: The Phishing Kit That Can Clone a Brand in Minutes
- The Bleeding Edge of Phishing: darcula-suite 3.0 Enables DIY Phishing of Any Brand
- Cybercriminals Can Now Clone Any Brand's Site in Minutes Using Darcula PhaaS v3
- 'Darcula' Phishing Kit Can Now Impersonate Any Brand
- darcula-suite V3 overview
Detection coverage for TL-2026-3372
As of 2026-10-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3372 across Splunk SPL, Microsoft KQL and Sigma, covering 14 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.