Following Major SMS Scammer’s Exposure, A New Scheme Emerges

If you’re one of the numerous individuals in the U.S. and elsewhere who have encountered scam texts about unpaid tolls or missing packages, you are likely a target of a widespread scamming operation.

Though the scam is quite simple, it has proven to be highly effective. By sending spam text messages that mimic genuine notifications from well-known services—covering anything from postal deliveries to local government announcements—unsuspecting victims click a link leading to a phishing site. There, they inadvertently input their credit card details, which are then captured for fraudulent use.

In just seven months during 2024, this scam reportedly compromised approximately 884,000 credit card details, allowing scammers to exploit victims’ accounts. Some individuals experienced significant financial losses, according to researchers.

However, a series of operational security mistakes ultimately uncovered the true identity of the creator of the scam software, known as Magic Cat, who operates under the pseudonym Darcula.

As reported by the Oslo-based security firm Mnemonic and Norwegian media earlier this year, behind the charming cat in Darcula’s profile is a 24-year-old Chinese national named Yucheng C.

Researchers assert that Yucheng C. is the mind behind Magic Cat, which is used by numerous clients to initiate their own SMS scam campaigns against unwary victims.

Following his identification, Darcula disappeared from online platforms, leaving his scamming activities devoid of updates and his clients in limbo. However, in his absence, a new scheme has surfaced and is swiftly outpacing its predecessor.

Researchers have raised alarms about the emerging fraudulent operation, Magic Mouse, which has arisen from the remnants of Magic Cat.

As he prepares to unveil new findings at the Def Con security conference in Las Vegas on Friday, Harrison Sand, an offensive security consultant at Mnemonic, informed TechCrunch that Magic Mouse has gained notable momentum since the downfall of Darcula’s Magic Cat.

Sand warned about the operation’s growing capability to illegally acquire credit card information on a large scale.

During their investigation, Mnemonic uncovered images shared in a Telegram channel managed by Darcula, displaying rows of credit card payment terminals and videos illustrating racks of numerous phones used to automate message distribution to victims.

The scammers utilize the card details through mobile wallets on various phones, committing payment fraud and laundering the proceeds into different bank accounts. Many devices were discovered with mobile wallets packed with stolen card information, ready for transactions.

Sand reported to TechCrunch that Magic Mouse is currently linked to the theft of at least 650,000 credit cards every month.

While evidence indicates that Magic Mouse represents a wholly new venture, created by different developers and likely disconnected from Darcula, its rapid success can be attributed to the new operators leveraging the phishing kits that made its predecessor so efficient. According to Sand, these kits encompass multiple phishing sites that Magic Cat employed to imitate genuine pages from major tech companies, well-known consumer services, and delivery organizations to fool victims into revealing sensitive credit card data.

Despite the far-reaching effects of both Magic Cat and, more recently, Magic Mouse, which have the potential to drain millions of dollars from consumers, Sand expressed to TechCrunch that law enforcement appears to be neglecting the broader operation behind the scam, concentrating instead on individual fraud reports.

Sand emphasized that tech companies and financial institutions bear the primary responsibility to combat these scams and complicate matters for fraudsters attempting to exploit stolen card data.

For anyone receiving suspicious texts, ignoring the unsolicited messages may be the smartest course of action.