So Long, and Thanks for All the Phish

So Long, and Thanks for All the Phish

Speakers: Harrison Sand, Erlend Leiknes

Conference: DEF CON 33

YouTube: https://www.youtube.com/watch?v=tJ4tG7nRUyU

Slides: https://media.defcon.org/DEF%20CON%2033/DEF%20CON%2033%20presentations/Harrison%20Sand%20Erlend%20Leiknes%20-%20So%20Long%2C%20and%20Thanks%20for%20All%20the%20Phish.pdf

Overview

Harrison Sand and Erlend Leiknes, both penetration testers at Norwegian security firm Mnemonic, delivered a methodical account of how they traced a single phishing SMS — impersonating the Norwegian Postal Service — all the way to the identity of the likely developer behind "Darcula," a professional phishing-as-a-service (PhaaS) platform operating out of China. What began in late 2023 as curiosity about a smishing pandemic became a multi-year investigation combining web application security skills, OSINT tradecraft, and investigative journalism collaboration. The research uncovered over 5,000 licenses issued across roughly 600 phishing operators, nearly 900,000 stolen credit card records, and eventually a specific individual in Hunan Province, China believed to be the primary developer — all documented in a 24-page report delivered to Europol and the FBI.

Background

▶ Watch: Research approach: unconventional investigation into a major PhaaS platform (2:17)

In late 2023, a wave of phishing SMS messages swept across Norway and many other countries, impersonating postal services and requesting that recipients click a link and pay a small "postage fee." The media response was generic: don't click, delete the message. Sand and Leiknes decided to take a more thorough approach. As web application security specialists, they treated the phishing kit as a piece of software to be reverse-engineered — and what they found went far beyond a simple phishing page.

The phishing operation was built around a kit called "Darcula" (also styled "Magic Cat" internally), which is a professionally developed, subscription-licensed, Chinese-language phishing-as-a-service platform. It provided operators with: customizable phishing pages impersonating postal services, banks, and major brands across dozens of countries; a real-time admin panel with live victim data streaming; built-in Telegram backup for stolen data; and an automated licensing server that issued time-limited activation keys to paying customers. The platform used Docker containerization for easy deployment, with a single install command standing up a complete phishing operation on a rented Linux VPS.

Key Findings

▶ Watch: Attribution: Darcula admin panel entirely in Chinese, origin confirmed (15:44)

Real-time victim surveillance via WebSockets. The phishing kit used Socket.io — a WebSocket framework — to stream victim data character by character to an operator admin panel as victims typed their information. Victims who reconsidered after entering partial data were already compromised: the "submit" button was irrelevant because data was transmitted keystroke by keystroke. By joining the admin WebSocket room (instead of the empty room new connections were assigned to by default), Sand and Leiknes gained real-time visibility into all active victims on that phishing server.

Client-side encryption with extractable keys. The WebSocket data was encrypted, but because the encryption was performed in JavaScript running in the victim's browser, the key was necessarily present in the JavaScript code. Setting a debugger breakpoint on the encrypt and decrypt functions revealed the key at runtime, enabling full decryption of all captured data.

Dual-purpose licensing architecture. The Darcula server codebase contained both the client (phishing kit) and the licensing server functionality. An if statement checked whether the current hostname matched the licensing server's hostname; if it did, a hidden admin menu became visible. By manipulating NGINX configurations to make the kit believe it was its own licensing server, the researchers were able to issue their own licenses and unlock the platform's full feature set — revealing admin interfaces, brand templates, and a Telegram data-backup system.

Authentication bypass. The kit's API included an authorization check that could be bypassed by providing specific Host and Referer HTTP headers. With these headers, any user could access the entire API without a valid admin token — a trivial IDOR that gave unauthenticated access to victim data, operator configuration, and internal API functions.

Scale of the operation. By fingerprinting the Darcula licensing server's HTTP stack via Shodan queries (the kit used a distinctive combination of server technologies), the researchers identified all phishing instances on the internet (~800 results, some false positives). Accessing the licensing server's API revealed that over a four-month period, more than 5,000 licenses had been issued, with each license tied to a Telegram handle, activation IP, and validity window. The platform impersonated over 200 brands across dozens of countries.

Technical Deep Dive

▶ Watch: Scale discovery: 5,000+ operator licenses, subscription-based PhaaS model (20:18)

Obfuscation layers. The kit's Node.js backend code was obfuscated using the open-source JavaScript Obfuscator tool. The researchers deobfuscated it using the complementary open-source tool Synchrony, recovering readable Node.js code that revealed internal architecture, licensing logic, and the dual-purpose server design.

Socket.io room structure. Socket.io organizes connections into "rooms" for message routing. Normal victim connections joined an empty room string; the admin backend subscribed to the admin room. By modifying the WebSocket join message to specify room: "admin", the researchers subscribed to the real-time admin feed — receiving a live stream of every victim's form data as it was entered on all active phishing pages served by that kit instance.

Fingerprinting and Shodan enumeration. The Darcula licensing server was hosted behind Cloudflare, obscuring its origin IP. However, each kit installation shared a distinctive combination of server technologies and response headers. The researchers built a Shodan fingerprint from these characteristics and queried the Shodan database, returning approximately 800 servers — including the licensing server itself, which was hosted at a Multicom-operated data center in Los Angeles.

Identity attribution chain. The OSINT chain that led to the developer's identity was multi-step:

1. An access log entry on the licensing server revealed the admin's source IP — a Alibaba Cloud VPS in Hong Kong, likely a VPN exit node.
2. Passive DNS records associated that IP with the domain ifShe.com from approximately one year prior.
3. That domain linked to a GitHub account whose project focus (Node.js, WebSocket frameworks, similar technology stack) matched the Darcula kit.
4. A commit history search in the GitHub repositories yielded an email address: myForch@ something (with a likely typo corrected to myForge).
5. OSINT Industries enumerated where that email address was registered, revealing PayPal and Apple account hints with partial phone numbers — one of which partially matched a phone number previously seen in the Darcula Telegram profile.
6. A URL shortener lure sent to the GitHub email address confirmed attribution: the click came from the same IP that accessed the Darcula licensing server backend.
7. An archived blog associated with the GitHub account contained a QQ number and a contact form.
8. Web Archive analysis of the GitHub account showed repositories that were deleted around the time Darcula was first publicly released, suggesting deliberate cleanup.
9. A downloaded .tar file from the Web Archive contained a Word document; metadata in the document listed an author name in Chinese characters. The same Chinese author name appeared in the metadata of installation guide documents uploaded by the Darcula Telegram account.
10. Cross-referencing the partial phone numbers (1,000 possibilities after reconciling inconsistent masking across PayPal and QQ hints) against public breach databases yielded seven candidate numbers. The third candidate matched: a profile photo associated with one of these numbers had appeared on an Instagram account with the username myForge — the same photo, with the same edits, not appearing anywhere else online.
11. A historical WHOIS lookup on that phone number returned an address in Hunan Province, China, identifying the individual believed to be the Darcula developer as Yucheng.

Demo / Proof of Concept

▶ Watch: Operational security failure: admin session captured from phishing infrastruc... (24:46)

The team ran a live demo at DEF CON 33, deploying an operational copy of the Darcula phishing kit and inviting attendees to scan a QR code and interact with it on their phones (using a test Luhn-valid card number rather than real credentials). The backend admin panel was then displayed on screen, showing the real-time character-by-character stream of attendee input populating the operator view — demonstrating exactly how phishing operators monitor victims in real time.

The demo also illustrated the kit's social engineering mechanism: after entering payment data, victims were shown a persistent loading screen with a spinning animation for approximately 90 seconds — a deliberate delay designed to make the victim believe a payment is being processed, keeping them on the page while operators real-time-verify the card details.

Defensive Implications

▶ Watch: OSINT pivot: linking operator identity through credential database leaks (33:48)

For individuals: The standard advice ("don't click the link, delete the message") is insufficient to prevent harm if someone clicks before realizing it's a phish. Because Darcula streams data keystroke by keystroke, even a partial entry of real card details is compromising. Users should be aware that the submit button is not a safety checkpoint.

For financial institutions and card issuers: The demo revealed that stolen cards were being rapidly provisioned into Google Wallet and Apple Pay. Once provisioned, a stolen card can be used indefinitely without re-prompting for the one-time PIN — card provisioning represents a critical control gap that fraud systems should flag aggressively.

For law enforcement: Phishing kits operating at this scale are essentially software companies. The licensing infrastructure, Telegram distribution channels, and real-world attribution trails (WHOIS, breach databases, metadata) provide actionable intelligence. The researchers produced a 24-page report, collaborated with Europol and the FBI, and also engaged investigative journalists who were able to travel to Southeast Asia and confront operators directly — suggesting that multi-stakeholder collaboration between security researchers, law enforcement, and media is the most effective response model.

For security teams: Darcula phishing pages evaded desktop browser detection by checking for mobile user agents and (apparently) mobile network IP ranges before serving the malicious page. Organizations running threat intelligence operations should test phishing detection tools from mobile IPs as well as desktop.

Key Takeaways

• Darcula is a professionally developed, subscription-licensed, Chinese-origin phishing-as-a-service platform that was responsible for at least 900,000 stolen credit card records and over 5,000 operator licenses across a four-month window observed by the researchers.
• The kit streams victim data keystroke-by-keystroke via WebSockets — bypassing any safety assumption that the "submit button" matters.
• A trivial WebSocket room-join manipulation and an HTTP header-based authentication bypass exposed full admin access and real-time victim monitoring without any privileged credentials.
• The licensing server's own access logs provided an IP that anchored a multi-step OSINT chain eventually leading to a named individual in Hunan Province, China.
• Investigative journalism — traveling physically to where operators operated, interviewing victims, and confronting suspects — was essential to the full story beyond what OSINT alone could establish.
• Stolen cards provisioned into mobile wallets can be used indefinitely after a single successful PIN entry, representing an underappreciated fraud amplifier.

About the Speaker(s)

▶ Watch: Disclosure impact: software stopped receiving updates after operator identified (42:44)

Harrison Sand and Erlend Leiknes are both penetration testers at Mnemonic, a Norwegian cybersecurity company. They specialize in web application security and brought those skills to bear on the Darcula phishing-as-a-service platform through a multi-year investigation. Their research was provided to Europol and the FBI, and they collaborated with Norwegian national broadcaster NRK, German public broadcaster ARD/BR (Bayerischer Rundfunk), and investigative outlet Lamont to extend the investigation into the physical world. DEF CON 33 was their first major international security conference appearance.