Darcula V3 turns real brand websites into customizable phishing pages. See how its smishing, payment fraud, and evasion tactics shape a practical response.
by Aarsh Jawa
A phishing page doesn't need to look cheap to be dangerous. With Darcula V3, an operator can copy a real brand's website, add forms that collect sensitive information, and turn a familiar customer experience into a trap. The logo, layout, and reassuring payment button can all look the part.
That's what makes the kit worth studying. Darcula packages the work of building and managing phishing campaigns into a service, so attackers can spend less time coding and more time finding people to deceive. Your brand's design system has become someone else's starter kit.
The practical question is how to spot and interrupt the campaign around the cloned page. A polished interface isn't proof of legitimacy, and a single blocked URL doesn't tell you whether the operator has stopped.
Earlier Darcula versions offered prebuilt pages for selected brands. V3 introduced darcula-suite, a tool for creating custom phishing pages from a supplied website URL. February 2025 reporting (opens in new tab) described the shift from a fixed template library to on-demand brand impersonation.
At a high level, the process combines four jobs:
The result can closely resemble the real website. That doesn't mean every clone is flawless or that every website can be reproduced without problems. It means attackers have a much easier route to a convincing page, including for smaller brands that weren't in the original template library.
An April 2025 update (opens in new tab) added generative AI to help create forms, translate copy, and customize pages. The useful distinction is between browser automation, which copies the page, and AI assistance, which helps modify it. Calling the whole process "AI phishing" can obscure which part defenders are actually trying to detect.
Doppelpedia's guide to phishing as a service explains the wider business model. Darcula clearly shows how a kit developer can sell reusable capabilities while individual operators choose the brand, audience, and lure.
Darcula's consumer campaigns often aim at payment details as well as personal data. A delivery message asks for a small fee. The cloned site collects a card number. A second screen asks for a verification code. Each request makes the next one feel like a normal continuation.
The platform has also been reported to generate card images from stolen details, helping criminals attempt to add those cards to digital wallets. That connects a web-based scam to potential in-person spending and the resale of devices loaded with stolen cards.
There's an important limit here: a generated image isn't a universal bypass for a bank's checks. Apple notes that banks or card issuers can require further authentication (opens in new tab) before approving a card for Apple Pay. Attackers may therefore try to capture the code or other information needed to complete provisioning.
For a fraud team, that changes the investigation. The suspicious transaction may come after a wallet-enrollment event, while the original scam looked like a modest delivery charge. For support teams, it makes reports of unexpected wallet notifications or verification requests worth escalating alongside reports of fake websites.
Customer communications should explain that sequence in plain language. Tell people what your brand actually asks for, where payments happen, and how to check an unexpected request through your official app or website. "Watch for bad spelling" is thin protection against a page copied from your own site.
Darcula built its reputation on messages that impersonate postal services and other trusted organizations. The page is the destination; the delivery alert, account notice, or payment reminder is what gets someone there. A good investigation keeps both.
Researchers have documented distribution via iMessage and RCS, as well as SMS. Those channels create a familiar mobile experience, but the messaging protocol doesn't establish the sender's authority to represent a brand. A blue bubble isn't a background check.
This smishing guide explains how these campaigns move from text to a website, chat, or call. That matters for training: an employee may encounter the lure on a personal phone, then follow it using a device that also accesses work accounts.
Teach the decision that breaks the chain. If a message asks someone to fix an account, pay a fee, or share a code, they can open the official service independently and check there. The rule works even when the scam page has excellent typography.
Darcula's use of Docker and familiar web technologies helps package the kit's components for deployment. Its dashboards and notifications also reduce the work involved in managing campaigns. None of those technologies is inherently malicious. The problem is the workflow they're supporting.
Treat the infrastructure as several connected parts:
Removing a landing page interrupts one part of that workflow. It doesn't automatically remove the operator's panel, remaining domains, or ability to deploy another copy. That is why follow-up monitoring belongs in the response plan, not as an optional extra.
In February 2025, researchers reported taking down more than 20,000 Darcula-related sites over roughly ten months. That's evidence of an established ecosystem, not a live count of V3 deployments. It also shows why removal and continued monitoring go hand in hand: A busy phishing operation can have more infrastructure than the first report reveals.
Darcula can place malicious content under a specific, randomized URL path and filter visitors by factors such as IP address, crawler behavior, or device type. An analyst who opens only the root domain may see a holding page instead of the scam the recipient saw.
That creates a visibility gap. Certificate Transparency and passive DNS help reveal hostnames and infrastructure changes; they don't reveal every page beneath a hostname. A certificate log can't describe what a particular path asks a visitor to submit.
It also doesn't follow that Darcula mainly lives on compromised, reputable websites. Earlier primary research described purpose-registered domains as a common hosting pattern. Compromised sites are a broader phishing risk, but mixing the two makes the investigation less precise.
Preserve the complete URL, the original message, and the conditions under which the page appeared. Record the redirect chain and screenshots when available. A bare hostname strips out details that may explain why one investigator sees the scam and another sees nothing.
Doppel's phishing site takedown guide walks through the response beyond the first URL, including distribution channels and signs of re-hosting. The aim is to shorten the campaign's opportunity to harm people and catch related assets when they reappear.
Darcula connects customer fraud, brand impersonation, and employee risk. Give those teams a shared response path so a suspicious text doesn't spend the afternoon being forwarded between inboxes.
Doppel's customer-targeted phishing workflow offers a useful model for that coordination. Track time to disruption, repeat activity, and customer harm alongside the number of URLs found. A busy detection dashboard is only useful if it helps the team act.
Doppel's Brand Protection helps teams find and disrupt external impersonation. The Threat Graph connects related campaign assets, while Simulation turns observed tactics into employee practice. Each addresses a different point in the journey from fake message to harmful action.
The goal is a repeatable loop: Find the scam, understand how it reaches people, disrupt the infrastructure, and improve the verification step that the scam tried to rush. A clone can borrow your brand's appearance. It shouldn't get to borrow your organization's trust without a challenge.
Request a Doppel demo to see how connected threat visibility and realistic simulations can help protect your employees and customers.
BLOG
Kali365 is a new phishing kit that steals Microsoft 365 access tokens without harvesting passwords or triggering MFA prompts. Learn how this FBI-highlighted threat abuses legitimate Microsoft authentication workflows—and what security teams must do to stop it.
by Aarsh Jawa
