Phishing -as-a-service (PhaaS) platform Darcula will release its third major release (Darcula Suite), which will include the ability to create do-it-yourself phishing kits (DIY), which can target any brand.
The version is currently available as a beta and promises to remove targeting scope restrictions, offering more phishing kits and allowing anyone to create their own.
The new version will also provide a user-friendly management dashboard, IP and bot filtering, phishing campaign , and automated credit card theft/digital wallet loading.
See also: Phishing attack hides JavaScript using Unicode
Netcraft researchers tested one of the latest beta versions of Darcula Suite and confirmed the existence of the new features.
The Darcula phishing service emerged last year and has become very popular among cybercriminals. It relies on 20,000 domains that spoof famous brands, aiming to trick users and steal credentials from Android and iOS devices. The targets are located in more than 100 countries.
The new, more powerful version has attracted even more users (criminals) even though it has not yet been officially released.
Darcula: New DIY phishing kits
As we mentioned earlier, the key feature of the upcoming Darcula Suite is the creation of DIY phishing kits, which allow “customers” to enter the URL for the brand they want to impersonate and the platform automatically creates all the required templates for the attack.
The platform clones the legitimate website using the Puppeteer tool, copying the HTML, CSS, images, and JavaScript.
See also: Phishing: Russian hackers exploit Signal's “Linked Devices” feature
The fraudster can choose which elements to modify , such as login fields, payment forms, and two-factor authentication messages , replace them with phishing pages, use error messages, or modify JavaScript, all of which will allow them to steal the data they are interested in .
The Darcula phishing service, especially the new version, offers pre-built templates, such as fake password reset pages, credit card payment forms, and 2FA password entry messages. Once configured, the phishing site is packaged into a “.cat-page” bundle that contains all the files necessary for the attack.
The phishing kit is then uploaded to the Darcula management panel to allow for deployment, centralized management, real-time data theft, and performance monitoring.
The introduction of the new Darcula version, with its powerful new features, makes detecting and stopping phishing campaigns even more difficult.
🔑 Secure your passwords with Proton Pass
Password manager from Proton — end-to-end encryption, passkeys, built-in 2FA, and monitoring for leaks of your credentials.
- ✔ Encrypted storage of passwords & passkeys
- ✔ Notification if any of your passwords are leaked (Dark Web Monitoring)
- ✔ Free version — on all devices
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
Netcraft comments that, over the past ten months, it has identified and blocked nearly 100,000 Darcula 2.0 domains, 20,000 phishing websites, and 31,000 IP addresses associated with the platform.
Protection
Users should be wary of messages they receive from strangers or from supposedly well-known companies. Many times, phishing attacks start with a simple message asking for the user's login details.
See also: New Device Code Phishing Attack Steals Authentication Tokens
Next, they should regularly update their software, including the operating system and applications. These updates often include security that can protect the user from the latest threats.
Using reliable security software, such as an antivirus or security app, can help protect against attacks. These tools can identify and block suspicious websites or messages that are trying to steal user information.
Finally, users should be careful when downloading applications from the internet. Many times, applications that seem innocent may contain hidden code that can steal user information or cause other security threats.
Source: www.bleepingcomputer.com
