DarkCore RAT Enables Session Hijacking of Gmail and WhatsApp
Original title: Hackers Can Use DarkCore RAT to Hijack Gmail and WhatsApp Sessions Without Passwords
DarkCore RAT allows attackers to hijack authenticated sessions in Gmail, WhatsApp and MediaFire using stolen cookies without needing passwords, requiring an existing endpoint foothold.
BlackFog researchers analyzed DarkCore, a remote access trojan marketed for session hijacking and credential theft. The malware supports hidden virtual network computing and reverse proxying through the victim’s IP. A distribution sample includes a PDF shortcut that downloads an additional executable while masquerading as a report launcher.
Unconfirmed: Advertised capabilities require further validation; distribution method unknown
- Requires existing foothold rather than new exploits
- Injects stolen cookies to impersonate users post-MFA
- HVNC provides hidden browser control interface
Impact: unauthorized access to authenticated email and messaging sessions
| Product | Affected |
|---|---|
| Microsoft Gmail and WhatsApp sessions | — |
- 1.Revoke compromised sessions and reset credentials
- 2.Correlate shortcut execution with suspicious downloads
- Malware
- DarkCore RAT
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | update.cdnlinks.org | while a separate command retrieves ReportPDFReader.exe from update[.]cdnlinks[.]org. Before launching either file, the shortcut attempts to |
| ipv4 | 217.156.8.148 | he recovered settings specify direct TCP communication with 217.156.8[.]148:43592. Tor and WebSocket options are disabled. Naming fie |
| sha256 | 2deedea02811bb8e288db1a96aac44bbfb533fd624b25f000823fa92baabd9a1 | 8:43592 Direct TCP C2 configured in the supplied executable 2deedea02811bb8e288db1a96aac44bbfb533fd624b25f000823fa92baabd9a1 SHA-256: ReportPDFReader.exe 5102c02a158bd53649de66ecf62796 |
| sha256 | 5102c02a158bd53649de66ecf627966f744e4fd46240523eb6cd11c348b2dfab | 533fd624b25f000823fa92baabd9a1 SHA-256: ReportPDFReader.exe 5102c02a158bd53649de66ecf627966f744e4fd46240523eb6cd11c348b2dfab SHA-256: PdfView.lnk Note: IP addresses and domains are int |
| url | https://update.cdnlinks.org/ReportPDFReader.exe | onstrated outcomes. Indicators of Compromise Indicator Role hxxps://update[.]cdnlinks[.]org/ReportPDFReader.exe Executable download configured in PdfView.lnk 217.156.8 |
From the original article
3 min read at gbhackers.com
DarkCore, a remote access trojan marketed with a dedicated browser for reusing stolen sessions, potentially letting attackers access Gmail, WhatsApp, and MediaFire without entering passwords. Its advertised reverse proxy routes traffic through the infected device’s IP address, making unauthorized activity resemble legitimate access from the victim.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.