A team of Norwegian cybersecurity researchers have unmasked the culprits behind a prolific criminal network claiming hundreds of thousands of victims, and offered a tantalising glimpse into the kind of lifestyle high-level cyber fraud offers.

Following an influx of scam delivery messages targeting people around the world back in 2023, the team from Oslo-based Mnemonic clicked the link and began an investigation that soon uncovered a vast phishing-as-a-service operation, known as Darcula.

First documented by security researcher Oshri Kalfon in 2023, reports last year indicated that the Darcula platform was offering cybercriminals 20,000 domains and 200 templates to spoof brands and steal credentials, targeting everything from postal services and tax agencies to telcos and airlines.  

Despite the platform being prolifically used by darkweb scammers, it remained online and continued to operate successfully from the shadows. However, after a little of what Mnemonic describes as ‘ethical hacking’, the team made their way into the network’s ‘admin’ room.

According to Mnemonic’s detailed report, the Darcula admin room was the heart of the cyber-criminal enterprise, and offered a real-time feed of hundreds of phishing victims details as they typed in card details, names and addresses.

Bringing on board the Norwegian Broadcasting Corporation (NRK), the investigation revealed that Darcula’s scam links had been clicked some 13 million times, with 884,000 cards being phished by around 600 fraudsters. 

Using reverse engineering techniques, Mnemonic discovered the backbone of Darcula’s operations, a toolkit dubbed ‘Magic Cat’, which allowed scammers to see stolen credit card data and interact with victims to request additional PIN-codes if required.

Mnemonic said that Darcula’s Magic Cat tool was quickly found to be ‘feature rich’, and included out-of-the-box support to impersonate a few hundred brands in countries around the world.

Digging further, the researchers claim to have discovered evidence linking Darcula to Chinese scammers, managing to pin down the full name, phone number, and city of one of the main criminals behind the phishing platform.

NRK’s subsequent investigation took in more than 40,000 chat messages between the supposedly Chinese scammers, watching them debate their exploits and show off the luxury goods they’d acquired with victims’ stolen cash.

In one picture, a fraudster flaunts a ring NRK alleged is worth more than £21,000, while another shows a collection of shoes from what appears to be the luxury brand Valentino. Going by the receipts one member of the Darcula network posted, they had spent at least £14,000 on shopping sprees.

Other photos were shared of sports cars, exclusive restaurants, and more luxury-branded clothing.

Despite confronting the hackers with their evidence and receiving thinly veiled threats in response, the investigators said that Darcula and the Magic Cat remain active and online, with new features reportedly making the tool even easier to use.  

Recommended reading

• Arctic Wolf Threat Report: Ransomware As A Service On the Rise
• Deepfake Fraud Explodes 2,000% In Three Years
• NHS Staff Don’t Think They’re Cyber Ready, BT Finds

“When we started looking into this phishing kit, our initial motivation was sparked by the obvious lack of information on the ongoing phishing campaigns,” concludes Mnemonic’s report.

“We wanted to find out more about who was behind this scamming operation and to understand how it worked. The result we hoped for, at the best, was to learn enough about the phishing campaigns to publish a post to inform our audience of how this works.

“Our research uncovered hundreds of thousands of victims, thousands of licences bought to use Magic Cat, and a mature ecosystem enabling the misuse of well-known brands from all over the world.”