Hackers Can Use DarkCore RAT to Hijack Gmail and WhatsApp Sessions Without Passwords

DarkCore, a remote access trojan marketed with a dedicated browser for reusing stolen sessions, potentially letting attackers access Gmail, WhatsApp, and MediaFire without entering passwords.

Its advertised reverse proxy routes traffic through the infected device’s IP address, making unauthorized activity resemble legitimate access from the victim.

The findings combine a cybercrime marketplace advertisement with analysis of a Windows executable and an accompanying malicious shortcut.

Crucially, researchers verified components of the malware, but did not establish that every advertised browser capability works.

A listing dated August 11, 2026, describes DarkCore as a native C++ implant supporting credential theft, file transfers, hidden desktop control and reverse proxying.

A seller screenshot displayed 118 credential rows, although these entries do not establish the number of compromised victims.

The central threat is session hijacking. Rather than completing a fresh login, an attacker reuses cookies representing an authenticated session.

Microsoft has documented how stolen session cookies can let attackers impersonate users after multifactor authentication has already been satisfied.

BlackFog security researchers uncovered DarkCore, advertised browser lists WhatsApp, YouTube, Gmail and MediaFire. According to its changelog, operators can inject stolen cookies and browse through the victim’s network connection.

DarkCore RAT Session

Separately, hidden virtual network computing, or HVNC, provides control of a browser running on a concealed Windows desktop.

Seller imagery shows Gmail open through this interface. Both approaches require an existing foothold on the endpoint, rather than exploiting a newly identified vulnerability in those services.

The accompanying PdfView.lnk shortcut masquerades as a “PDF Report Launcher” and uses a PDF icon.

Launching it opens a minimized command window that downloads a legitimate World Bank report alongside an executable.

Its commands conceal curl.exe and START through string slicing, character removal and CALL expansion.

The decoy opens as a temporary PDF while a separate command retrieves ReportPDFReader.exe from update[.]cdnlinks[.]org.

Before launching either file, the shortcut attempts to delete its Zone.Identifier alternate data stream, potentially reducing download-related warnings.

The operations are independent: failure to retrieve the document does not prevent the payload download attempt.

Researchers could not verify whether the remotely hosted executable matched their analyzed sample. The shortcut’s original distribution method also remains unknown.

The unsigned, 64-bit Windows sample contains the DARKCORE01 marker and interfaces associated with remote desktop and HVNC.

Researchers recovered its configuration by reversing a decoder that rotates key bytes and XORs 758 bytes in the .data2 section.

The recovered settings specify direct TCP communication with 217.156.8[.]148:43592. Tor and WebSocket options are disabled.

Naming fields use backgroundTaskHost.exe and backgroundTaskHost, imitating a legitimate Windows process, although installation and startup persistence flags are disabled in this build.

Additional modules can be mapped into memory or written as DLLs before loading. The disk-based path creates filenames beginning with “dc,” loads them through LoadLibraryA, then attempts deletion.

The wider lesson is that password protection alone cannot contain an authenticated-session compromise. Microsoft recommends revoking compromised sessions alongside resetting credentials and investigating attacker changes.

For this investigation, defenders should correlate shortcut execution, suspicious curl downloads, the recovered command-and-control endpoint and transient DLL activity, while treating the advertised account-hijacking functions as claims requiring further validation rather than independently demonstrated outcomes.

Indicators of Compromise

Indicator	Role
hxxps://update[.]cdnlinks[.]org/ReportPDFReader.exe	Executable download configured in PdfView.lnk
217.156.8[.]148:43592	Direct TCP C2 configured in the supplied executable
2deedea02811bb8e288db1a96aac44bbfb533fd624b25f000823fa92baabd9a1	SHA-256: ReportPDFReader.exe
5102c02a158bd53649de66ecf627966f744e4fd46240523eb6cd11c348b2dfab	SHA-256: PdfView.lnk

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.