Google disrupts “Darcula” scam network behind millions of fake delivery texts
Fake package delivery text message sent by criminals. Image: Ampyx News
BY KERRY TOMLINSON, AMPYX NEWS
Google is chipping away at the scam infrastructure of a crime group known as Darcula. The company has taken down at least 300 internet domains related to the group's activity.
For years, Darcula sent out millions of fake texts messages claiming a problem with a package delivery, leading to millions of dollars stolen world-wide. Google sued the group in December. In April, the company won an injunction allowing them to impact Darcula's criminal infrastructure.
How did Darcula pull off its multi-million dollar crimes?
WATCH HERE:
Package delivery
You've probably gotten a phone message saying you have a package coming your way, but there’s a delivery issue.
What happens if you click on the link?
Two cyber investigators in Norway, Harrison Sand and Erlend Leiknes from security company Mnemonic, decided to find out after one of them received that same message. What they found was far more than they ever imagined.
The Message
An incorrect address. Package not delivered. Click here to fix it. The researchers did, and it took them to a postal service site that looked very real.
"Once we clicked it, they also said, 'Oh, you need to add some postage fee.'" Leiknes said in an interview. "Like, less than a dollar. It turned out for the people who fell for it, it was not less than a dollar."
They dug into the fake site, and through intensive investigation, finally discovered the data going back and forth between customers and criminals. They were surprised to see credit card numbers from around the world streaming live across the screen, as people entered their data into the fake postal forms.
"It was just hundreds and hundreds of victims flying by in real time, and we're like, 'Okay, this is pretty serious,'" Sand said. "This is a really large-scale operation happening."
Who is it?
In all the data, one word stood out: Darcula, like 'Dracula,' but with the 'a' and 'r' switched.
"I think we all share the same curiosity. Who is behind this? Who is trying to rob me?" Leiknes said. "I think people have the right to know."
Their investigation eventually led to Telegram, a messaging platform often used for crime. There, they found a criminal group going by the name Darcula.
Members of the group sold the use of their scam software, called Magic Cat, that creates copycat sites of postal services and toll road services, among others. They shared instructions on how to trick people and steal money, the researchers said.
Magic cat brought them riches, according to the members' posts, showing luxury cars, parties in expensive bars, expensive trips in first class, high-end clothing, shoes and jewelry.
"Maseratis and Ferraris and going out to extremely fancy clubs," Sand said. "They were doing pretty well for themselves,
"Some people liked to boast and brag and show pictures of how much they spend, how they spend our stolen money," Leiknes said.
How do they do it?
First, they used phone farms to send the messages to you and millions of other people, the researchers said. Video obtained by Mnemonic shows dozens of phones on racks in a room, continuously sending out messages.
"This is like a hundred, a couple hundred people, and then they're able to send a text message to basically everybody on the planet, which is kind of crazy," Sand said.
As soon as you typed in your credit card number, the thieves added your card to their phone's virtual wallet. They loaded the wallets with dozens of stolen cards, then sold the phones to other thieves.
"So, you could go on the dark web and just buy a phone with stolen credit cards on it," Sand explained.
The next phase
It doesn't end there. The Straits Times in Singapore reported on the next phase of this kind of scam after a series of arrests in 2024.
In some cases, the criminals recruit so-called mules and send them to other countries with the loaded phones, police said. The mules buy more phones and luxury items, which are later sold for money.
Singapore police arrested at least five people in one week in November 2024, as well as several more in 2025 and 2026, but many more are out there, out of the eye of law enforcement.
Life of crime
Who is Darcula?
"We were really curious," Sand said. "Who are these people?”
The researchers contacted the Norwegian public news organization, NRK, to take things further. Three members of the group caught NRK's eye, and the news organization traveled to Asia to try to meet them.
Kris
First, a man who appeared to go by the name Kris on Instagram. NRK reported that he also used the name X667788x on Telegram, where he offered a $1300 course on how to scam with Magic Cat.
NRK took the course undercover and said x667788x claimed to be a partner of Darcula himself, the main person behind Magic Cat.
"You can pay with other people's credit cards when you go out," he told them, according to the NRK report. "It saves a lot of money. I pick up women and never spend my own money."
Confronted on Telegram, he told them, "I'm x66, but all the information you found is false."
Soon after, Kris's account was deleted from Instagram, NRK reported.
Ken
Next, the news organization tracked down Ken, an x66 connection, through a bartender at a bar in Bangkok.
"If you have any evidence, you can go to the police station," he told them by phone.
Later, he sent a picture of multiple firearms, saying they should come over so he can beat them up, NRK reported.
"You kind of get the impression that they're quick money opportunists," Sand said. "Like, 'I'm on the other side of the world, nobody's ever going to come after me.'"
Darcula
The final member of the trio is Darcula himself, who hides behind cat pictures online and keeps a low profile.
"I'm just a beautiful man who can't be restrained," he posted, according to NRK.
But NRK was able to locate his identity card. They said he is Yucheng C., in his twenties, from China.
"Given the right opportunity, he could probably have had a job doing something else a bit more legitimate and been quite successful," Sand said.
"He's a smart guy," he added. "Ethics, not so good."
Why do they do it?
Yucheng C. wouldn't talk to NRK.
Later, someone calling themselves Lao Liu contacted NRK, claiming Yucheng had resigned from the company.
"We only sell the software that creates websites," Lao Liu said. "We do not encourage people to use it for phishing."
But NRK's investigation shows otherwise. Lao Liu admitted Magic Cat is being used for fraud.
"I know, we will shut it down," he told them.
But the scams continued.
A reckoning
Google filed a lawsuit against Yucheng Chang and the Darcula group in December 2025, in part because Darcula was using Google's name and logo.
In April 2026, Google was awarded an injunction against Darcula, with a finding that Darcula had violated federal statutes like the Computer Fraud and Abuse Act and the Racketeer Influenced and Corrupt Organizations or RICO Act, Google said.
The court order allowed Google take down Darcula infrastructure. Google said it has served the order on Darcula service providers and registrars, disrupting or suspending 300 related domains.
Other researchers had investigated Darcula's activities before, though apparently not as far as Leiknes and Sand. From a single text to a multimillion-dollar global theft scheme.
"Not in a million years would I have guessed that I would have gone this far," Sand said.
"That's something that we are proud of having done," Leiknes said.
What to do?
What should you do if you get a text message that looks like it's from your post office, or your bank or a toll road charge?
Don't click, like the researchers did.
If you think the message could be real, connect with the company separately, not through the text message. Otherwise, report it and delete it.
Click, and you could end up fueling a criminal group's lavish lifestyle. On your card.
ALSO IN THE NEWS:
