New DarkCore RAT Leverages Stolen Session Cookies and Victim IPs for Stealthy Access
A new remote access trojan, DarkCore, is being marketed with a custom browser that reuses stolen session cookies for services like Gmail and WhatsApp, while routing traffic through victims' IP addresses to mask malicious activity.
A novel remote access trojan (RAT) named DarkCore has emerged, posing a significant threat by employing a custom-built browser designed to hijack authenticated sessions for popular services such as Gmail and WhatsApp. This malware further enhances its stealth capabilities by routing its network traffic through the IP addresses of its victims, a technique that can convincingly disguise unauthorized access as legitimate user activity. The Windows-based malware combines several malicious functionalities, including credential theft, file transfer capabilities, a reverse proxy, and hidden remote desktop access.
Researchers from BlackFog identified DarkCore during routine threat hunting and analyzed a marketplace listing dated August 11, 2026. Their technical analysis confirmed the malware's ability to load modules and manage its configuration. However, they noted a distinction between the seller's advertised features and the independently verified code behavior, particularly regarding the full extent of the custom browser's session cookie reuse capabilities. While the analysis confirmed the core functionality of session injection and traffic routing, not all advertised browser features could be independently verified.
The core of DarkCore's appeal to attackers lies in its exploitation of session cookies. These cookies represent a successful login, allowing an attacker to bypass traditional authentication methods. By reusing stolen cookies from services like Gmail, WhatsApp, YouTube, and MediaFire, threat actors can gain access to user accounts without needing to know the actual passwords. This method undermines security protections that are typically applied during the login process, making detection more challenging.
DarkCore's custom browser reportedly allows operators to inject stolen session cookies and route their browser traffic through the infected device's IP address. The seller claims this proxy functionality ceases when the last browser window associated with that session is closed. This feature is intended to make malicious browsing activity appear as if it originates from a trusted, familiar IP address, thereby blending in with normal network traffic. However, these remain seller-described functions, and the extent of their validation is limited.
Beyond session hijacking, DarkCore also advertises a hidden virtual network computing (HVNC) capability. This allows an operator to remotely control a browser instance running on the victim's Windows desktop without the user's knowledge or visibility. This is akin to other hidden desktop functionalities seen in malware, enabling attackers to operate within existing browser sessions without altering the visible desktop environment, further increasing the difficulty of detection.
The malware's delivery mechanism, as analyzed by BlackFog, involves a malicious shortcut disguised with a PDF icon. When executed, this shortcut initiates a minimized command window that downloads a decoy document (purportedly a World Bank report) and separately retrieves the DarkCore executable. The commands employ obfuscation techniques to conceal the download and launch processes, and they attempt to remove the Zone.Identifier stream, a Windows marker associated with internet downloads, to reduce security warnings.
While BlackFog could not obtain a hash for the remotely hosted executable to confirm it matched their sample, the examined sample was an unsigned, 64-bit Windows executable. Researchers were able to recover its configuration by decoding encoded bytes, revealing settings for direct TCP communication, disabled Tor and WebSocket options, and unset flags for installation and startup persistence. Additional modules can be loaded directly into memory or via temporary DLL files.
For detection and response, BlackFog recommends monitoring command-shell downloads, process ancestry, file signatures, and network connections. If theft is suspected, endpoints should be isolated, evidence preserved, unauthorized transfers stopped, active sessions revoked, and affected credentials reset. The IoCs provided include the executable download URL, C2 IP/port, and SHA-256 hashes for the executable and shortcut.