# Darcula V3 Phishing Kit: On-Demand Brand Cloning via darcula-suite

> Darcula V3 is a phishing-as-a-service kit whose darcula-suite component uses browser automation to clone any brand's website into a phishing page from a supplied URL, replacing fixed templates. Campaigns are delivered by smishing (SMS, iMessage, RCS) and harvest payment card details, personal information and verification codes through multi-step flows.

- **Published:** 2026-10-12T20:21:32Z
- **Last reviewed:** 2026-10-12T20:21:32Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3372
- **ID:** TL-2026-3372
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 14 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Darcula is a phishing-as-a-service (PhaaS) platform first exposed by Netcraft in March 2024. Version 2 shipped roughly 200 pre-built templates covering postal services, financial institutions, government bodies, airlines and telecommunications providers across 100+ countries. Darcula V3, announced by the developer on Telegram on 19 January 2025, delayed on 10 February 2025 and observed in mid-February 2025, introduces darcula-suite, a tool that removes the fixed-template limit.

The operator supplies a brand URL in a web interface. Headless Chrome driven by Puppeteer-style browser automation captures the HTML and all required assets. The operator then selects HTML elements to replace and injects phishing content such as payment forms and login fields, styled to match the brand. Front-end production takes about 10 minutes. The suite produces multi-page flows (lure, address, card details, 2FA/verification code) and exports them as a .cat-page bundle that is uploaded to an admin panel. Doppel describes the suite as automating four operations: website capture, form modification for data collection, deployment packaging, and campaign administration through operator dashboards.

Netcraft observed Docker-based deployment. Images are pulled from registry.magic-cat.world (v3/web and v3/api) using an installer at v3.magic-cat.world/install.sh. The stack uses React admin dashboards, a Node.js backend and an SQLite database. Telegram is used for command and notification channels, including victim confirmations. The developer channel had over 1,200 subscribers. Chinese-language announcements and machine-translated interfaces point to Chinese-origin criminal operators; no named actor attribution is made in the sources.

Victims are lured by smishing over SMS, iMessage and RCS, typically impersonating postal services and financial institutions. Stolen card details are used to generate card images for provisioning into digital wallets on burner phones. Netcraft reports devices pre-loaded with up to 20 stolen cards circulating in adjacent Telegram communities. An April 2025 update added generative AI for form generation, translation and page customization (per Doppel).

Evasion measures include randomized deployment URL paths per campaign, filtering of visitors by IP address, crawler behavior and device type (blocking non-mobile analysis tools), conditional content serving, and client-side React rendering that requires JavaScript execution. Hosting is commonly on purpose-registered domains, with compromised websites as a secondary option. Netcraft reports more than 95,000 Darcula phishing domains and about 31,000 IP addresses detected and over 20,000 sites taken down since March 2024. Doppel reports removing more than 20,000 Darcula-related sites over roughly ten months. Neither source lists victim-facing phishing domains or named targeted brands for V3. Severity is analyst-assigned; no CVE or CVSS applies.

## MITRE ATT&CK

- T1583.001 Domains
- T1608.005 Link Target
- T1598.003 Spearphishing Link
- T1566.002 Spearphishing Link
- T1204.001 Malicious Link
- T1684.001 Impersonation
- T1480 Execution Guardrails
- T1056.003 Web Portal Capture
- T1111 Multi-Factor Authentication Interception
- T1657 Financial Theft

## Sources

- [Darcula V3: The Phishing Kit That Can Clone a Brand in Minutes](https://www.doppel.com/blog/darcula-v3-brand-cloning-phishing-kit)
- [The Bleeding Edge of Phishing: darcula-suite 3.0 Enables DIY Phishing of Any Brand](https://netcraft.com/blog/darcula-v3-phishing-kits-targeting-any-brand)
- [Cybercriminals Can Now Clone Any Brand's Site in Minutes Using Darcula PhaaS v3](https://thehackernews.com/2025/02/cybercriminals-can-now-clone-any-brands.html)
- ['Darcula' Phishing Kit Can Now Impersonate Any Brand](https://www.darkreading.com/threat-intelligence/darcula-phishing-kit-impersonate-brand)
- [darcula-suite V3 overview](https://www.idagent.com/blog/darcula-suite-v3/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3372