# DarkCore RAT: native C++ implant hijacks Gmail and WhatsApp sessions via cookie injection

> DarkCore is a native C++ remote access trojan advertised on a cybercrime marketplace on 2026-08-11 and analyzed by BlackFog. It offers credential theft, file transfer, hidden desktop control (HVNC), reverse proxying and a dedicated browser that reuses stolen session cookies (Gmail, WhatsApp, YouTube, MediaFire) without a password.

- **Published:** 2026-10-26T21:56:33Z
- **Last reviewed:** 2026-10-26T21:56:33Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4492
- **ID:** TL-2026-4492
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 15 (full data via the Threadlinqs MCP server — Purple tier)

## Description

DarkCore is an unsigned 64-bit native C++ Windows RAT sold on a cybercrime marketplace (listing dated 2026-08-11). BlackFog researchers, who found it through marketplace monitoring, reverse engineered the executable and the delivery shortcut and published their analysis on 2026-10-22. Advertised capabilities are credential theft (service URLs and passwords), file transfer, hidden desktop control (HVNC), a reverse proxy that routes operator traffic through the victim's IP address, and a dedicated browser that imports stolen session cookies to access Gmail, WhatsApp, YouTube and MediaFire as the victim. Because the browser reuses already-authenticated sessions, no password or MFA prompt is required. A marketplace screenshot showed 118 credential rows; researchers note this does not establish victim count and that advertised browser capabilities could not all be independently verified.

Delivery in the analyzed sample is a malicious shortcut, PdfView.lnk, which uses a PDF icon and presents itself as a 'PDF Report Launcher'. It starts a minimized command window running commands obfuscated with string slicing, character removal and CALL expansion so that curl.exe and START are not visible as plain text. The chain downloads a legitimate World Bank report as a decoy, downloads ReportPDFReader.exe from hxxps://update[.]cdnlinks[.]org/, attempts to delete the Zone.Identifier alternate data stream (Mark-of-the-Web) to suppress warnings, and opens the decoy while the payload runs independently.

The implant stores its configuration in a .data2 section protected by 758 bytes of XOR encryption with key byte rotation. The recovered configuration specifies direct TCP communication to 217.156.8.148 port 43592 with Tor and WebSocket options disabled, the executable name backgroundTaskHost.exe and the registry label backgroundTaskHost, which borrow the name of a legitimate Windows process. The binary contains the marker string DARKCORE01. Installation and startup persistence flags were set to zero in the analyzed build, so persistence was not exercised in that sample, although the capability is present in the configuration. Additional modules are either mapped directly into memory or written to disk as DLLs with filenames starting 'dc' (built from tick count and process ID), loaded with LoadLibraryA and then deleted on a best-effort basis. Remote desktop and HVNC interfaces were identified in the binary. A third hash (DLL resource 101) was reported in one write-up.

No CVE, vulnerability, named threat actor or nation-state attribution is stated in the sources. The tool is sold commercially, so operators are likely multiple and the motivation is assessed as financial. Defenders should correlate shortcut execution, cmd.exe spawning curl.exe to fetch executables into temporary storage, the C2 endpoint, backgroundTaskHost.exe running outside its legitimate path/signature/parent, and transient dc-prefixed DLL activity. Response to session theft should revoke sessions, reset credentials and review attacker-made account changes.

## MITRE ATT&CK

- T1204.002 Malicious File
- T1059.003 Windows Command Shell
- T1129 Shared Modules
- T1027.010 Command Obfuscation
- T1553.005 Mark-of-the-Web Bypass
- T1036.005 Match Legitimate Resource Name or Location
- T1620 Reflective Code Loading
- T1070.004 File Deletion
- T1550.004 Web Session Cookie
- T1539 Steal Web Session Cookie
- T1555.003 Credentials from Web Browsers
- T1021.005 VNC
- T1090 Proxy
- T1095 Non-Application Layer Protocol
- T1571 Non-Standard Port
- T1185 Browser Session Hijacking
- T1547.001 Registry Run Keys / Startup Folder

## Sources

- [MITRE ATT&CK T1185 Browser Session Hijacking](https://attack.mitre.org/techniques/T1185/)
- [MITRE ATT&CK T1553.005 Mark-of-the-Web Bypass](https://attack.mitre.org/techniques/T1553/005/)
- [DarkCore: A Data-Theft RAT With a Session-Hijacking Browser](https://www.blackfog.com/darkcore-a-data-theft-rat-with-a-session-hijacking-browser/)
- [Hackers Can Use DarkCore RAT to Hijack Gmail and WhatsApp Sessions Without Passwords](https://gbhackers.com/darkcore-rat-sessions/)
- [New DarkCore RAT Lets Hackers Masquerade as Victims Using Stolen Browser Sessions](https://cyberpress.org/darkcore-hijacks-browser-sessions/)
- [New Research Exposes DarkCore RAT That Hijacks Accounts Without Passwords](https://itnerd.blog/2026/10/22/new-research-exposes-darkcore-rat-that-hijacks-accounts-without-passwords/)
- [DarkCore RAT: New Research Into Credential Theft and Stolen Browser Sessions (OffSeq Threat Radar)](https://radar.offseq.com/threat/darkcore-rat-new-research-into-credential-theft-and-stolen-browser-sessions-63b63e0dc67955d2)
- [MITRE ATT&CK T1539 Steal Web Session Cookie](https://attack.mitre.org/techniques/T1539/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4492