Google’s Threat Intelligence Group has documented a large-scale Chinese-language phishing-as-a-service operation, anchored by the Darcula platform (UNC5814), active across 119 countries and targeting financial institutions, e-commerce, and securities firms. The platform intercepts one-time passcodes in real time to defeat MFA, then automatically loads stolen payment card data into attacker-controlled digital wallets, enabling contactless fraud without the physical card. Any organization offering consumer-facing authentication or payment services faces direct exposure; the industrialized scale and MFA-bypass capability make this a material financial and reputational risk.