DarkCore RAT Hijacks Gmail and WhatsApp Sessions While Browsing From the Victim's Own IP

A remote access trojan called DarkCore is being sold on an underground forum with an unusual selling point: a built-in browser that loads stolen session cookies and pushes its traffic out through the infected computer. To Gmail, WhatsApp Web or any other service, the attacker's activity appears to come from the victim's usual device and network location.

What happened

The listing, posted in mid-August 2026 and updated since, pitches DarkCore as a "higher-end" Windows RAT for operators who want stealth. The feature sheet reads like a full toolkit: credential and cookie theft, file transfer, a reverse proxy, a clipper, hidden-desktop remote control (HVNC) and an optional Tor transport. Version 2.0.1 was current at the time of the listing.

The headline feature is the dedicated browser. Promotional material shows it holding sessions for Gmail, WhatsApp, YouTube and MediaFire, with cookies harvested from a victim injected straight into the attacker's browsing session. According to the seller's changelog, that session can be tunnelled through the infected host's IP address, and the tunnel closes when the last browser window for that session is shut.

These browser claims deserve caution. Analysis of a real sample confirmed how the client is configured and how it loads modules, but the browser features remain seller-described rather than independently validated. A promotional screenshot listing 118 credential rows says nothing reliable about how many victims actually exist.

How it gets onto a machine

The sample arrived alongside a Windows shortcut file dressed up with a PDF icon and named as if it were a report viewer. Opening it launches a minimised command window that does two things: it downloads a genuine World Bank report to show the user, and it separately fetches an executable from a remote host. The commands are obfuscated with string slicing, character stripping and CALL expansion, and they attempt to delete the Zone.Identifier stream from both downloads so that Windows raises fewer warnings.

Two details stand out. The executable is fetched even if the decoy PDF fails, and the launch command never checks whether the download succeeded. How the shortcut first reaches victims is still unknown, and because the remote payload could not be retrieved for hashing, it is also not confirmed that the live download is the same binary as the analysed sample.

What the sample revealed

The analysed binary is an unsigned 64-bit Windows executable. Its configuration is protected by a simple scheme: a 32-byte key is rotated and XORed across 758 bytes of encoded data. Once decoded, the settings showed direct TCP command-and-control, Tor and WebSocket transports switched off, and the installation and startup persistence flags left unset. Additional modules can be loaded straight into memory or dropped on disk as temporary DLL files.

Why it matters

A session cookie is proof of a login that has already succeeded. Replaying it skips the password prompt and any multi-factor challenge that was applied at sign-in. Combine that with traffic that exits from the victim's own IP address and you remove the two signals most organisations rely on to spot account takeover: an unfamiliar location and an unusual device. A familiar IP address does not prove that the legitimate user is at the keyboard.

What to do

• Correlate endpoint and account telemetry. Look for command-shell processes spawning downloads, suspicious process ancestry under shortcut files, unsigned executables with PDF-themed names, and outbound TCP connections to unexpected ports. Account logs alone will not catch this.
• Treat .lnk files as executables. Block or quarantine shortcut files arriving by email or download, and alert when cmd.exe is launched from a shortcut.
• Watch for Mark-of-the-Web tampering. Deletion of the Zone.Identifier stream right after a download is a strong signal.
• If you suspect session theft, act on the account, not just the host. Isolate the endpoint, preserve evidence, stop any file transfers, then revoke every active session and reset the affected credentials. A password change without session revocation leaves the attacker logged in.
• Shorten session lifetimes for high-value accounts and bind sessions to device characteristics where your identity provider supports it.

Cookies and credentials stolen with tools like DarkCore end up in exactly the marketplaces where this malware is sold. 4tify's Deep/Dark Web monitoring watches those channels for your organisation's domains, email addresses and session dumps, so a compromised account can be revoked before it is resold or used.

Indicators of compromise

Indicators are defanged. Re-fang them only inside a controlled threat-intelligence platform or your SIEM.