New DarkCore RAT Targets Gmail and WhatsApp Sessions While Hiding Behind Victims’ IP Addresses

A newly uncovered remote access trojan called DarkCore is being marketed with a browser designed to reuse stolen Gmail, WhatsApp, and other account sessions while routing traffic through victims’ IP addresses.

The approach could make unauthorized account access look like normal activity from an already trusted connection. The Windows malware combines advertised credential theft, file transfers, a reverse proxy, and hidden desktop access.

However, researchers drew an important line between the seller’s claims and confirmed code behavior: their analysis established the client’s configuration and module loading, but did not independently verify every advertised browser feature.

Researchers from BlackFog identified DarkCore during routine threat hunting and examined a marketplace listing dated August 11, 2026.

Their published technical malware analysis compared promotional screenshots with a supplied Windows executable and an accompanying malicious shortcut. A screenshot contained 118 credential rows, but that figure does not establish how many victims were compromised.

New DarkCore RAT Targets Gmail and WhatsApp Sessions

Session cookies represent a login that has already succeeded. Instead of entering a password and completing another authentication challenge, an attacker may reuse a valid stolen session.

Earlier reporting on Cookie-Bite session theft attacks explains the same broader risk: stealing authenticated cookies can undermine protections applied during login.

DarkCore’s seller showed Gmail, WhatsApp, YouTube, and MediaFire inside its dedicated browser. According to the advertised changelog, operators can inject stolen cookies and send browser traffic through the infected device’s IP address.

The proxy reportedly stops when the last browser window associated with that session closes. These remain seller-described functions rather than fully validated findings.

The distinction matters because a familiar IP address does not prove that the legitimate user controls an account. Victim-IP routing is intended to disguise unauthorized access as ordinary browsing.

Investigators therefore need to connect account activity with endpoint evidence rather than treating a recognized network address as sufficient reassurance.

DarkCore also advertises hidden virtual network computing, or HVNC, which lets an operator control a browser on a Windows desktop the victim cannot see.

Similar MedusaHVNC hidden desktop capabilities illustrate how attackers can work inside existing browser sessions without changing the visible desktop. DarkCore’s promotional interface showed Chrome open on Gmail.

PDF Shortcut Delivery and Technical Findings

The accompanying shortcut uses a PDF icon and presents itself as a report launcher. Opening it starts a minimized command window that downloads a genuine World Bank report as a decoy and separately retrieves an executable.

String slicing, character removal, and CALL expansion conceal the underlying download and launch commands. Before opening either download, the commands attempt to remove its Zone.Identifier stream, the Windows marker associated with internet downloads.

This can reduce warnings. The executable download is attempted even if the decoy PDF fails, and its launch command does not check whether retrieval succeeded. How attackers originally distributed the shortcut remains unknown.

This resembles PDF decoy delivery techniques reported in another RAT campaign, where a document distracts the user while malicious code runs.

BlackFog could not hash the remotely hosted executable, so it could not confirm that the download matched the supplied sample it examined.

That sample was an unsigned, 64-bit Windows executable. Researchers recovered its settings by reproducing a decoder that rotates bytes from a 32-byte key and XORs them against 758 encoded bytes.

The configuration selected direct TCP communication, disabled Tor and WebSocket options, and left installation and startup persistence flags unset.

Additional modules can load directly into memory or through temporary DLL files written to disk. For detection, BlackFog recommends examining command-shell downloads, process ancestry, file signatures, and network connections together.

If theft is suspected, responders should isolate the endpoint, preserve evidence, stop unauthorized transfers, revoke active sessions, and reset affected credentials.

Indicators of compromise (IoCs):-

Type	Indicator	Role
URL	hxxps://update[.]cdnlinks[.]org/ReportPDFReader.exe	Shortcut-configured executable download
IP:port	217.156.8[.]148:43592	Configured direct TCP C2
SHA-256	2deedea02811bb8e288db1a96aac44bbfb533fd624b25f000823fa92baabd9a1	ReportPDFReader.exe
SHA-256	5102c02a158bd53649de66ecf627966f744e4fd46240523eb6cd11c348b2dfab	PdfView.lnk
SHA-256	0530f78227fa92b7b2d716c6a8253405a83e4b9b4a0c84736f1a0863ff500925	Embedded DLL resource 101

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.