A newly discovered Remote Access Trojan (RAT) named DarkCore is exploiting stolen Gmail, WhatsApp, YouTube and MediaFire sessions—and routing traffic through victims’ IP addresses to disguise illicit access as legitimate browsing. Researchers uncovered the malware during routine threat hunting after spotting a marketplace listing advertising these capabilities. The finding highlights a sophisticated abuse of session cookies and compromised endpoints that could let attackers bypass common security checks undetected.
How DarkCore Operates
DarkCore includes a custom browser designed to reuse authenticated session cookies—login credentials typically validated once—so attackers can avoid replaying login flows or multi-factor checks. Along with that, it proxies browser traffic through the victim’s machine. Because the IP address matches the victim’s, activity appears to emerge from a trusted device, making detection more difficult. Experts were able to verify the client configuration and some modules, though they didn’t confirm every advertised feature from the marketplace listing.
Hidden Virtual Network Computing (HVNC) capabilities are also claimed: this allows malicious operators to run invisible browser windows on an infected Windows desktop, letting them browse accounts like Gmail without the user seeing what’s happening. The promotional content showed Chrome launched into Gmail, behaving as if the user themselves were typing.
Infection Vector and Technical Details
To infect targets, DarkCore uses a decoy—typically a shortcut that masquerades as a PDF report launcher. Double-clicking the icon opens a legitimate World Bank report as a distraction while a separate malicious executable is quietly downloaded. Attackers deploy obfuscation techniques like stripping string literals and slicing character sequences, and remove Windows markers that flag files as downloaded from the internet, helping the malware fly under the radar.
BlackFog analysts examined a supplied 64-bit, unsigned Windows executable variant. Its configuration showed direct TCP communication, with both Tor and WebSocket options off, and persistence mechanisms not activated by default. Additional modules could be loaded either directly into system memory or through temporary DLLs placed on disk. The researchers recovered configuration details by reversing byte-rotation and XOR-based encoding methods.
Risk Indicators and Response Steps
Several Indicators of Compromise (IoCs) have been published: a URL for downloading the malicious executable, C2 communication with a specific IP and port, and SHA-256 hashes for the executable, its fake shortcut, and an embedded DLL. Without visibility into endpoint processes, network traffic, or file signatures, detection will be difficult.
To respond to potential compromises, organizations are urged to isolate affected endpoints, preserve forensic evidence, halt unauthorized file transfers, revoke active user sessions, and force resets of impacted credentials. These containment steps are vital before larger exposure spreads.
With attackers leaning more on session hijacking and IP-spoofing tactics, defenders must adapt: simply relying on known IP addresses or networks as trust signals is no longer enough. Monitoring endpoint behavior and detecting anomalies around process ancestry and temporary DLL loadings are becoming essential layers of defense.
