Skip to content
NewA calmer, faster ZeroHour
StoryMalwarehigh

BlackFog analyzes DarkCore RAT sold for session hijacking

2 sources · 2 articlesFirst reported Updated ()1
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

BlackFog analyzed DarkCore, a Windows RAT sold to hijack Gmail and WhatsApp sessions after an existing foothold.

BlackFog analyzed DarkCore, a Windows remote access trojan sold for session hijacking and credential theft. The seller advertises cookie injection for Gmail, WhatsApp, and other sessions, plus traffic routed through the victim’s IP; GBHackers also names MediaFire and hidden VNC. Cyber Security News says analysis of an unsigned 64-bit executable and PDF-icon shortcut confirmed direct TCP settings, temporary or in-memory DLL loading, and a decoy download, but not every advertised browser feature. The tool requires an existing foothold, and initial shortcut distribution is unknown. BlackFog advises revoking sessions and resetting affected credentials.

Key facts
  • Requires an existing endpoint foothold; no new exploits are described.
  • Sample is an unsigned 64-bit executable paired with a PDF-icon shortcut.
  • Config used direct TCP; install and startup persistence were unset.
  • Marketplace listing examined by researchers was dated August 11, 2026.
  • A screenshot showed 118 credential rows, not a victim count.
  • BlackFog could not hash the hosted executable against the sample.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Aug 11, 2026DarkCore marketplace listing examined by researchers · Cyber Security News

What each outlet adds

beyond the shared facts
  • GBHackersNames MediaFire, hidden VNC, and reverse proxying through the victim IP.
  • Cyber Security NewsLimits verification, lists TCP config, listing date, and 118 rows.
Products
GmailWhatsApp
Malware
DarkCoreDarkCore RAT
Organizations
BlackFog

Coverage

oldest first · one row per article · UTC
  1. · 4d ago GBHackersFirst report

    DarkCore RAT Enables Session Hijacking of Gmail and WhatsApp

    DarkCore RAT allows attackers to hijack authenticated sessions in Gmail, WhatsApp and MediaFire using stolen cookies without needing passwords, requiring an existing endpoint foothold.

  2. · 3d ago Cyber Security News

    DarkCore RAT marketed to reuse Gmail and WhatsApp sessions

    BlackFog verified a Windows sample’s config and modules, not every seller-advertised browser feature.