This session unveils the inner workings of Darcula, the largest phishing-as-a-service (PhaaS)
operations active globally. Through meticulous investigation, we trace Darcula’s infrastructure,
from its impersonation of 236 brands to the 30.000+ active phishing domains and 884000+
stolen cards uncovered. This behind-the-scenes journey combines forensic analysis and opensource
intelligence (OSINT). The audience will gain rare insights into PhaaS ecosystems, technical
obfuscation tactics, and the human factors behind these operations. This talk is ideal for
cybersecurity professionals, law enforcement, policy makers, and anyone interested in the
intersection of cybercrime and international cooperation.
