DarkCore RAT targets Gmail, WhatsApp sessions, hides behind victim IPs

Key Takeaways

• A new Remote Access Trojan (RAT) named DarkCore is being actively marketed with advanced session hijacking capabilities.
• DarkCore specifically targets popular services like Gmail and WhatsApp, aiming to reuse stolen session cookies.
• A key feature is its ability to route attacker traffic through the victim’s IP address, making unauthorized access appear legitimate.
• The malware is delivered via deceptive PDF shortcut files that simultaneously download a decoy document and the malicious executable.
• While researchers have confirmed many features, some advertised browser functionalities require further independent verification.

DarkCore RAT Emerges with Sophisticated Session Hijacking

A recently identified remote access trojan, dubbed DarkCore, is making waves in underground markets, boasting a custom browser designed to exploit stolen session data from services such as Gmail and WhatsApp. This sophisticated malware aims to obscure malicious activity by routing traffic directly through the compromised user’s IP address, potentially making unauthorized account access indistinguishable from legitimate user activity.

The Windows-based malware integrates a suite of features including credential harvesting, file transfer capabilities, a reverse proxy, and hidden desktop access. However, researchers from BlackFog identified a crucial distinction: while their analysis confirmed the client’s configuration and module loading, not all advertised browser functionalities have been independently verified through code analysis.

Stealthy Session Reuse and IP Masquerading

The core threat posed by DarkCore lies in its exploitation of session cookies. These cookies represent a pre-established, authenticated login, allowing an attacker to bypass traditional password entry and multi-factor authentication by simply reusing a valid, stolen session. This technique echoes the risks highlighted by previous “Cookie-Bite” attacks, where compromised authentication tokens can render login security measures ineffective.

DarkCore’s promotional materials showcase its dedicated browser accessing services like Gmail, WhatsApp, YouTube, and MediaFire. The advertised changelog indicates that operators can inject stolen cookies and direct all browser traffic through the infected device’s IP address. This proxy functionality reportedly ceases once the associated browser window is closed. It is important to reiterate that these remain seller claims, not fully validated technical findings.

The ability to route traffic through a victim’s IP address is a significant concern for forensic investigations. A familiar IP address can mislead security teams into believing that account activity is legitimate, even when an attacker is actively controlling the session. This necessitates a more thorough investigative approach, connecting account activity directly with endpoint evidence rather than relying solely on network address recognition.

Furthermore, DarkCore promotes hidden virtual network computing (HVNC) capabilities. This feature allows an attacker to control a browser session on a Windows desktop without the victim being aware of the activity. Similar to MedusaHVNC, this enables attackers to operate within existing browser sessions, performing actions that remain invisible to the legitimate user.

Deceptive Delivery and Technical Architecture

DarkCore’s delivery mechanism employs a cunning social engineering tactic. The malware is typically delivered via a malicious shortcut file disguised with a PDF icon, appearing as a report launcher. When executed, this shortcut initiates a minimized command window. This window simultaneously downloads a legitimate World Bank report as a decoy and, in a separate action, retrieves the malicious executable.

The underlying download and launch commands are obscured through string slicing, character removal, and CALL expansion. Before initiating either download, the commands attempt to strip the Zone.Identifier stream, a Windows marker for internet downloads, which can bypass security warnings. The executable download proceeds even if the decoy PDF fails, and its launch command does not verify successful retrieval. The initial distribution method of this shortcut remains unconfirmed.

This method of using a decoy document to distract the user while malicious code executes mirrors techniques observed in other RAT campaigns. BlackFog’s analysis of the remotely hosted executable was limited as they could not hash it, preventing confirmation that the downloaded file matched their examined sample.

The analyzed sample was an unsigned, 64-bit Windows executable. Researchers successfully recovered its configuration by reverse-engineering a decoder that employs byte rotation and XOR operations. The configuration specified direct TCP communication, with Tor and WebSocket options disabled, and installation and startup persistence flags initially unset. DarkCore is designed to load additional modules either directly into memory or via temporary DLL files written to disk.

What You Should Do

• Implement Multi-Factor Authentication (MFA): Even if session cookies are stolen, MFA can add an extra layer of defense, making it harder for attackers to gain full access.
• Educate Users on Phishing and Malicious Shortcuts: Train employees to recognize suspicious email attachments, especially those disguised as common document types, and to be wary of shortcuts.
• Monitor Endpoint Activity: Look for unusual command-shell downloads, suspicious process ancestry, and unexpected network connections.
• Deploy Advanced Endpoint Detection and Response (EDR): EDR solutions can help detect and respond to the initial stages of infection, such as the execution of malicious shortcuts and subsequent downloads.
• Regularly Review and Revoke Active Sessions: Periodically review active sessions for critical accounts (e.g., email, cloud services) and revoke any unfamiliar or suspicious sessions.
• Reset Compromised Credentials Immediately: If a compromise is suspected, isolate the affected endpoint, preserve forensic evidence, and promptly reset all potentially affected user credentials.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.