DarkCore RAT marketed to reuse Gmail and WhatsApp sessions
Original title: New DarkCore RAT Targets Gmail and WhatsApp Sessions While Hiding Behind Victims’ IP Addresses
BlackFog verified a Windows sample’s config and modules, not every seller-advertised browser feature.
BlackFog identified DarkCore, a Windows remote access trojan sold with a browser that the seller says can inject stolen Gmail, WhatsApp, and other session cookies and route traffic through the victim’s IP. Analysis of a supplied unsigned 64-bit executable and a PDF-icon shortcut confirmed direct TCP configuration, in-memory or temporary DLL module loading, and a decoy download path, but not every advertised browser function. How the shortcut was first distributed is unknown.
Unconfirmed: Cookie injection, victim-IP routing, and HVNC remain seller claims; initial distribution and sample-to-download match are unconfirmed.
- Marketplace listing examined was dated August 11, 2026.
- A screenshot showed 118 credential rows; that does not count victims.
- Config used direct TCP and left install and startup persistence unset.
- BlackFog could not hash the remotely hosted executable against the sample.
- Responders are told to revoke sessions and reset affected credentials.
Impact: Stolen sessions, remote desktop control, and file access
| Product | Affected |
|---|---|
| Windows | — |
- 1.Isolate the endpoint, preserve evidence, and stop unauthorized transfers.
- 2.Revoke active sessions and reset affected credentials.
- 3.Review command-shell downloads, process ancestry, signatures, and network connections together.
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | update.cdnlinks.org | tors of compromise (IoCs):- Type Indicator Role URL hxxps://update[.]cdnlinks[.]org/ReportPDFReader.exe Shortcut-configured executable down |
| ipv4 | 217.156.8.148 | FReader.exe Shortcut-configured executable download IP:port 217.156.8[.]148:43592 Configured direct TCP C2 SHA-256 2deedea02811bb8e28 |
| sha256 | 0530f78227fa92b7b2d716c6a8253405a83e4b9b4a0c84736f1a0863ff500925 | 627966f744e4fd46240523eb6cd11c348b2dfab PdfView.lnk SHA-256 0530f78227fa92b7b2d716c6a8253405a83e4b9b4a0c84736f1a0863ff500925 Embedded DLL resource 101 Note: IP addresses and domains ar |
| sha256 | 2deedea02811bb8e288db1a96aac44bbfb533fd624b25f000823fa92baabd9a1 | port 217.156.8[.]148:43592 Configured direct TCP C2 SHA-256 2deedea02811bb8e288db1a96aac44bbfb533fd624b25f000823fa92baabd9a1 ReportPDFReader.exe SHA-256 5102c02a158bd53649de66ecf627966 |
| sha256 | 5102c02a158bd53649de66ecf627966f744e4fd46240523eb6cd11c348b2dfab | b533fd624b25f000823fa92baabd9a1 ReportPDFReader.exe SHA-256 5102c02a158bd53649de66ecf627966f744e4fd46240523eb6cd11c348b2dfab PdfView.lnk SHA-256 0530f78227fa92b7b2d716c6a8253405a83e4b9 |
| url | https://update.cdnlinks.org/ReportPDFReader.exe | . Indicators of compromise (IoCs):- Type Indicator Role URL hxxps://update[.]cdnlinks[.]org/ReportPDFReader.exe Shortcut-configured executable download IP:port 217.156 |
From the original article
3 min read at cybersecuritynews.com
A newly uncovered remote access trojan called DarkCore is being marketed with a browser designed to reuse stolen Gmail, WhatsApp, and other account sessions while routing traffic through victims’ IP addresses. The approach could make unauthorized account access look like normal activity from an already trusted connection. The Windows malware combines advertised credential theft, file […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.