New DarkCore RAT Targets Gmail and WhatsApp Sessions While Hiding Behind Victims’ IP Addresses

A newly uncovered remote access trojan called DarkCore is being marketed with a browser designed to reuse stolen Gmail, WhatsApp, and other account sessions while routing traffic through victims’ IP addresses.

The approach could make unauthorized account access look like normal activity from an already trusted connection. The Windows malware combines advertised credential theft, file transfers, a reverse proxy, and hidden desktop access.

However, researchers drew an important line between the seller’s claims and confirmed code behavior: their analysis established the client’s configuration and module loading, but did not independently verify every advertised browser feature.

Researchers from BlackFog identified DarkCore during routine threat hunting and examined a marketplace listing dated August 11, 2026.

Their published technical malware analysis compared promotional screenshots with a supplied Windows executable and an accompanying malicious shortcut. A screenshot contained 118 credential rows, but that figure does not establish how many victims were compromised.

New DarkCore RAT Targets Gmail and WhatsApp Sessions

Session cookies represent a login that has already succeeded. Instead of entering a password and completing another authentication challenge, an attacker may reuse a valid stolen session.

Earlier reporting on Cookie-Bite session theft attacks explains the same broader risk: stealing authenticated cookies can undermine protections applied during login.

DarkCore’s seller showed Gmail, WhatsApp, YouTube, and MediaFire inside its dedicated browser. According to the advertised changelog, operators can inject stolen cookies and send browser traffic through the infected device’s IP address.

The proxy reportedly stops when the last browser window associated with that session closes. These remain seller-described functions rather than fully validated findings.

The distinction matters because a familiar IP address does not prove that the legitimate user controls an account. Victim-IP routing is intended to disguise unauthorized access as ordinary browsing.

Investigators therefore need to connect account activity with endpoint evidence rather than treating a recognized network address as sufficient reassurance.

DarkCore also advertises hidden virtual network computing, or HVNC, which lets an operator control a browser on a Windows desktop the victim cannot see.

Similar MedusaHVNC hidden desktop capabilities illustrate how attackers can work inside existing browser sessions without changing the visible desktop. DarkCore’s promotional interface showed Chrome open on Gmail.

PDF Shortcut Delivery and Technical Findings

The accompanying shortcut uses a PDF icon and presents itself as a report launcher. Opening it starts a minimized command window that downloads a genuine World Bank report as a decoy and separately retrieves an executable.

String slicing, character removal, and CALL expansion conceal the underlying download and launch commands. Before opening either download, the commands attempt to remove its Zone.Identifier stream, the Windows marker associated with internet downloads.

This can reduce warnings. The executable download is attempted even if the decoy PDF fails, and its launch command does not check whether retrieval succeeded. How attackers originally distributed the shortcut remains unknown.

This resembles PDF decoy delivery techniques reported in another RAT campaign, where a document distracts the user while malicious code runs.

BlackFog could not hash the remotely hosted executable, so it could not confirm that the download matched the supplied sample it examined.

That sample was an unsigned, 64-bit Windows executable. Researchers recovered its settings by reproducing a decoder that rotates bytes from a 32-byte key and XORs them against 758 encoded bytes.

The configuration selected direct TCP communication, disabled Tor and WebSocket options, and left installation and startup persistence flags unset.

Additional modules can load directly into memory or through temporary DLL files written to disk. For detection, BlackFog recommends examining command-shell downloads, process ancestry, file signatures, and network connections together.

If theft is suspected, responders should isolate the endpoint, preserve evidence, stop unauthorized transfers, revoke active sessions, and reset affected credentials.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post New DarkCore RAT Targets Gmail and WhatsApp Sessions While Hiding Behind Victims’ IP Addresses appeared first on Cyber Security News.