Threat reportMalwareTL-2026-4507
DarkCore RAT Targets Gmail and WhatsApp Sessions While Hiding Behind Victims' IP Addresses
DarkCore RAT Targets Gmail and WhatsApp Sessions While (TL-2026-4507), also tracked as DarkCore, is a high-severity malware campaign, first published 2026-10-27. It has no confirmed attribution, affects Microsoft Windows, maps to 14 MITRE ATT&CK techniques (T1027, T1036.005, T1059.003), and is covered by 9 detection rules and 14 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 14MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 14Indicators of compromise
Key facts for TL-2026-4507
- Threat ID
- TL-2026-4507
- Also known as
- DarkCore
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Detection rules
- 9
- Indicators of compromise
- 14
Malware and tooling in DarkCore RAT Targets Gmail and WhatsApp Sessions While
Malware and tooling: DarkCore
How DarkCore RAT Targets Gmail and WhatsApp Sessions While works
DarkCore is a native C++ Windows remote access trojan advertised on a cybercrime marketplace with session-cookie reuse (Gmail, WhatsApp, YouTube, MediaFire), a reverse proxy through the victim's IP, HVNC and credential theft. A sample was delivered via a PDF-themed shortcut (PdfView.lnk) that uses curl.exe to fetch a World Bank decoy report and the ReportPDFReader.exe payload.
DarkCore is a Windows remote access trojan identified by BlackFog researchers (analysis published 2026-10-22) after a marketplace listing dated 2026-08-11. The seller advertises credential theft (service URL, username, password rows; the listing displayed 118 credential rows), file transfer between operator and victim, hidden virtual network computing (HVNC), a dedicated browser that reuses stolen session cookies, and a reverse proxy that routes operator traffic through the victim's IP address. Targeted services named in the advertisement are Gmail, WhatsApp, YouTube and MediaFire. The malware is a native C++ implementation. BlackFog explicitly separates the seller's claims from confirmed code behavior: they verified configuration extraction and module loading but did not independently validate every advertised browser feature.
The analyzed delivery chain starts with a shortcut file named PdfView.lnk, disguised with a PDF icon as a 'PDF Report Launcher'. Its command line is obfuscated through string slicing, character removal and CALL expansion. When decoded, it uses curl.exe to download a World Bank report decoy to %TMP%\b[RANDOM].pdf (visual distraction) and separately downloads the payload ReportPDFReader.exe from https://update.cdnlinks.org/ReportPDFReader.exe. It attempts to remove the Zone.Identifier alternate data stream from both files to suppress Mark-of-the-Web warnings. The initial delivery vector to the victim (e.g., email) is not stated in the sources.
The examined payload is an unsigned 64-bit Windows executable. Its configuration, recovered offline by reimplementing the decoder (a byte-rotation decoder with a 32-byte XOR key over a 758-byte blob in the .data2 section), shows C2 host 217.156.8.148, port 43592, direct TCP transport (Tor and WebSocket options disabled), executable name backgroundTaskHost.exe, registry label backgroundTaskHost, client label client_1, retry base 5000 ms, and all persistence flags set to zero in this build. Additional modules are loaded either by direct in-memory mapping or by dropping a temporary DLL named dc[8-hex tick count][4-hex process id].dll, with attempted deletion after execution. An embedded DLL resource (resource 101) was also hashed.
Because the reverse proxy and session-cookie reuse make attacker access originate from the victim's own IP, sign-in IP reputation checks may not flag the unauthorized access. Defenders should revoke sessions, not just reset passwords. No CVE, CVSS score or threat-actor attribution is stated in the sources; severity is analyst-assigned.
MITRE ATT&CK techniques used in TL-2026-4507
Defense Evasion
T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1070.004 File Deletion; T1140 Deobfuscate/Decode Files or Information; T1620 Reflective Code Loading
Execution
T1059.003 Windows Command Shell; T1204.002 Malicious File
Command and Control
T1090 Proxy; T1095 Non-Application Layer Protocol; T1219 Remote Access Tools; T1571 Non-Standard Port
Credential Access
T1539 Steal Web Session Cookie; T1555.003 Credentials from Web Browsers
defense-impairment
Affected products and versions in DarkCore RAT Targets Gmail and WhatsApp Sessions While
- Microsoft — Windows
Vulnerable versions: 64-bit Windows (no specific versions stated)
Remediation for DarkCore RAT Targets Gmail and WhatsApp Sessions While
Immediate actions
- Block 217.156.8.148:43592 and update.cdnlinks.org at the perimeter and DNS layer
- Isolate endpoints where PdfView.lnk, ReportPDFReader.exe or backgroundTaskHost.exe executed
- Revoke active sessions and tokens for Gmail, WhatsApp, YouTube and MediaFire accounts used on affected hosts, then reset credentials
- Preserve temporary DLLs (dc*.dll) and downloaded files for forensics
Workarounds
- Use endpoint egress monitoring to block unauthorized outbound transfers
- Enforce device-bound session or token binding where supported to limit stolen-cookie reuse
Longer-term hardening
- Alert on cmd.exe spawning curl.exe with output to %TMP%
- Alert on Zone.Identifier stream removal and on backgroundTaskHost.exe running outside its legitimate path
- Review mailbox access logs and file downloads against the infection timeline; do not trust sign-in IP alone, since victim-IP routing camouflages access
- Restrict or block .lnk attachments and downloads from untrusted sources
Timeline of DarkCore RAT Targets Gmail and WhatsApp Sessions While
- DarkCore RAT is advertised on a cybercrime marketplace as a commercial malware-as-a-service offering with session-cookie reuse, reverse proxy, HVNC and credential theft features; the seller posted console screenshots of the credential manager and browser interface (listing displayed 118 credential rows).
- BlackFog identifies DarkCore during threat hunting of marketplace listings (analysis start is approximated to the day after the listing; exact day not stated) and analyzes a sample delivered via PdfView.lnk.
- Published analysis confirms the 758-byte .data2 configuration blob decodes with a byte-rotation routine and 32-byte XOR key; Tor and WebSocket options are disabled and all persistence flags are zero in the analyzed build.
- BlackFog publishes 'DarkCore: A Data Theft RAT with a Session-Hijacking Browser' (author Rebecca Harpur) with the delivery chain, decoded configuration (C2 217.156.8.148:43592 over direct TCP, backgroundTaskHost.exe, client_1, retry base 5000 ms), module-loading behavior and three SHA-256 hashes.
- Threadlinqs begins tracking DarkCore as an active malware threat with published IOCs; no CVE, CVSS score or attribution stated.
- Cyber Security News publishes coverage of the BlackFog analysis, including the payload URL, C2 and three SHA-256 hashes.
Sources cited for DarkCore RAT Targets Gmail and WhatsApp Sessions While
- New DarkCore RAT Targets Gmail and WhatsApp Sessions While Hiding Behind Victims' IP Addresses
- DarkCore: A Data Theft RAT with a Session-Hijacking Browser (BlackFog)
- MITRE ATT&CK T1553.005 Subvert Trust Controls: Mark-of-the-Web Bypass
- MITRE ATT&CK T1539 Steal Web Session Cookie
- MITRE ATT&CK T1620 Reflective Code Loading
- MITRE ATT&CK T1219 Remote Access Software
Detection coverage for TL-2026-4507
As of 2026-10-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4507 across Splunk SPL, Microsoft KQL and Sigma, covering 14 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.