Threat reportMalwareTL-2026-4492
DarkCore RAT: native C++ implant hijacks Gmail and WhatsApp sessions via cookie injection
DarkCore RAT (TL-2026-4492) is a high-severity malware campaign, first published 2026-10-26. It has no confirmed attribution, affects Microsoft Windows, maps to 17 MITRE ATT&CK techniques (T1021.005, T1027.010, T1036.005), and is covered by 9 detection rules and 15 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 17MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 15Indicators of compromise
Key facts for TL-2026-4492
- Threat ID
- TL-2026-4492
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- technology, general-enterprise, consumer
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 15
Malware and tooling in DarkCore RAT
Malware and tooling: DarkCore
How DarkCore RAT works
DarkCore is a native C++ remote access trojan advertised on a cybercrime marketplace on 2026-08-11 and analyzed by BlackFog. It offers credential theft, file transfer, hidden desktop control (HVNC), reverse proxying and a dedicated browser that reuses stolen session cookies (Gmail, WhatsApp, YouTube, MediaFire) without a password.
DarkCore is an unsigned 64-bit native C++ Windows RAT sold on a cybercrime marketplace (listing dated 2026-08-11). BlackFog researchers, who found it through marketplace monitoring, reverse engineered the executable and the delivery shortcut and published their analysis on 2026-10-22. Advertised capabilities are credential theft (service URLs and passwords), file transfer, hidden desktop control (HVNC), a reverse proxy that routes operator traffic through the victim's IP address, and a dedicated browser that imports stolen session cookies to access Gmail, WhatsApp, YouTube and MediaFire as the victim. Because the browser reuses already-authenticated sessions, no password or MFA prompt is required. A marketplace screenshot showed 118 credential rows; researchers note this does not establish victim count and that advertised browser capabilities could not all be independently verified.
Delivery in the analyzed sample is a malicious shortcut, PdfView.lnk, which uses a PDF icon and presents itself as a 'PDF Report Launcher'. It starts a minimized command window running commands obfuscated with string slicing, character removal and CALL expansion so that curl.exe and START are not visible as plain text. The chain downloads a legitimate World Bank report as a decoy, downloads ReportPDFReader.exe from hxxps://update[.]cdnlinks[.]org/, attempts to delete the Zone.Identifier alternate data stream (Mark-of-the-Web) to suppress warnings, and opens the decoy while the payload runs independently.
The implant stores its configuration in a .data2 section protected by 758 bytes of XOR encryption with key byte rotation. The recovered configuration specifies direct TCP communication to 217.156.8.148 port 43592 with Tor and WebSocket options disabled, the executable name backgroundTaskHost.exe and the registry label backgroundTaskHost, which borrow the name of a legitimate Windows process. The binary contains the marker string DARKCORE01. Installation and startup persistence flags were set to zero in the analyzed build, so persistence was not exercised in that sample, although the capability is present in the configuration. Additional modules are either mapped directly into memory or written to disk as DLLs with filenames starting 'dc' (built from tick count and process ID), loaded with LoadLibraryA and then deleted on a best-effort basis. Remote desktop and HVNC interfaces were identified in the binary. A third hash (DLL resource 101) was reported in one write-up.
No CVE, vulnerability, named threat actor or nation-state attribution is stated in the sources. The tool is sold commercially, so operators are likely multiple and the motivation is assessed as financial. Defenders should correlate shortcut execution, cmd.exe spawning curl.exe to fetch executables into temporary storage, the C2 endpoint, backgroundTaskHost.exe running outside its legitimate path/signature/parent, and transient dc-prefixed DLL activity. Response to session theft should revoke sessions, reset credentials and review attacker-made account changes.
MITRE ATT&CK techniques used in TL-2026-4492
Lateral Movement
Defense Evasion
T1027.010 Command Obfuscation; T1036.005 Match Legitimate Resource Name or Location; T1070.004 File Deletion; T1620 Reflective Code Loading
Execution
T1059.003 Windows Command Shell; T1129 Shared Modules; T1204.002 Malicious File
Command and Control
T1090 Proxy; T1095 Non-Application Layer Protocol; T1571 Non-Standard Port
Collection
T1185 Browser Session Hijacking
Credential Access
T1539 Steal Web Session Cookie; T1555.003 Credentials from Web Browsers
Persistence
T1547.001 Registry Run Keys / Startup Folder
lateral-movement
defense-impairment
Affected products and versions in DarkCore RAT
Remediation for DarkCore RAT
Immediate actions
- Block outbound TCP to 217.156.8.148:43592 and DNS/HTTP(S) to update.cdnlinks.org at the perimeter
- Hunt for PdfView.lnk and ReportPDFReader.exe by SHA-256 and filename across endpoints and mail/web gateways
- Revoke active sessions and refresh tokens for accounts used on affected hosts, then reset credentials
- Review mailbox rules, forwarding, connected apps and other account changes made by an attacker
Workarounds
- Detonate or block shortcut files delivered from the internet at email and web gateways
- Use application control to prevent unsigned executables from running out of user profile and temp directories
Longer-term hardening
- Alert on cmd.exe launching curl.exe to download executables into user-writable or temp paths
- Alert on backgroundTaskHost.exe running from a non-system path, unsigned, or with an unexpected parent process
- Restrict .lnk execution from downloaded archives and email attachments; keep Mark-of-the-Web enforcement
- Adopt token binding / device-bound sessions and short session lifetimes for webmail and collaboration apps
Timeline of DarkCore RAT
- DarkCore RAT is advertised on a cybercrime marketplace, listing credential theft, HVNC, reverse proxy and a session-hijacking browser; a manager screenshot shows 118 credential rows
- BlackFog discloses three SHA-256 hashes (ReportPDFReader.exe, PdfView.lnk, embedded DLL resource 101) and the staging URL hxxps://update.cdnlinks.org/ReportPDFReader.exe
- BlackFog's published analysis documents the decoded implant configuration: direct TCP C2 217.156.8.148:43592, Tor and WebSocket selectors off, client label client_1, 5000 ms retry base, and install/Run-key/task/additional persistence flags all set to 0 in the analyzed build
- ITnerd reports on the BlackFog research that DarkCore hijacks accounts without passwords
- BlackFog publishes 'DarkCore: A Data-Theft RAT With a Session-Hijacking Browser', detailing the PdfView.lnk delivery chain, XOR-protected .data2 configuration and C2 217.156.8.148:43592
- BeaconBeagle lookup of C2 217.156.8.148 returns HTTP 404 (no C2 beacon record at time of research); no CVE or named threat actor is associated with DarkCore
- Cyber Press publishes its write-up of the BlackFog findings, including the DARKCORE01 marker and dc-prefixed module naming
- GBHackers on Security covers DarkCore's ability to hijack Gmail and WhatsApp sessions, restating BlackFog's IOCs
Sources cited for DarkCore RAT
- MITRE ATT&CK T1185 Browser Session Hijacking
- MITRE ATT&CK T1553.005 Mark-of-the-Web Bypass
- DarkCore: A Data-Theft RAT With a Session-Hijacking Browser
- Hackers Can Use DarkCore RAT to Hijack Gmail and WhatsApp Sessions Without Passwords
- New DarkCore RAT Lets Hackers Masquerade as Victims Using Stolen Browser Sessions
- New Research Exposes DarkCore RAT That Hijacks Accounts Without Passwords
- DarkCore RAT: New Research Into Credential Theft and Stolen Browser Sessions (OffSeq Threat Radar)
- MITRE ATT&CK T1539 Steal Web Session Cookie
Detection coverage for TL-2026-4492
As of 2026-10-26, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4492 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.