# DarkCore RAT Targets Gmail and WhatsApp Sessions While Hiding Behind Victims' IP Addresses

> DarkCore is a native C++ Windows remote access trojan advertised on a cybercrime marketplace with session-cookie reuse (Gmail, WhatsApp, YouTube, MediaFire), a reverse proxy through the victim's IP, HVNC and credential theft. A sample was delivered via a PDF-themed shortcut (PdfView.lnk) that uses curl.exe to fetch a World Bank decoy report and the ReportPDFReader.exe payload.

- **Published:** 2026-10-27T03:18:10Z
- **Last reviewed:** 2026-10-27T03:18:10Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4507
- **ID:** TL-2026-4507
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 14 (full data via the Threadlinqs MCP server — Purple tier)

## Description

DarkCore is a Windows remote access trojan identified by BlackFog researchers (analysis published 2026-10-22) after a marketplace listing dated 2026-08-11. The seller advertises credential theft (service URL, username, password rows; the listing displayed 118 credential rows), file transfer between operator and victim, hidden virtual network computing (HVNC), a dedicated browser that reuses stolen session cookies, and a reverse proxy that routes operator traffic through the victim's IP address. Targeted services named in the advertisement are Gmail, WhatsApp, YouTube and MediaFire. The malware is a native C++ implementation. BlackFog explicitly separates the seller's claims from confirmed code behavior: they verified configuration extraction and module loading but did not independently validate every advertised browser feature.

The analyzed delivery chain starts with a shortcut file named PdfView.lnk, disguised with a PDF icon as a 'PDF Report Launcher'. Its command line is obfuscated through string slicing, character removal and CALL expansion. When decoded, it uses curl.exe to download a World Bank report decoy to %TMP%\b[RANDOM].pdf (visual distraction) and separately downloads the payload ReportPDFReader.exe from https://update.cdnlinks.org/ReportPDFReader.exe. It attempts to remove the Zone.Identifier alternate data stream from both files to suppress Mark-of-the-Web warnings. The initial delivery vector to the victim (e.g., email) is not stated in the sources.

The examined payload is an unsigned 64-bit Windows executable. Its configuration, recovered offline by reimplementing the decoder (a byte-rotation decoder with a 32-byte XOR key over a 758-byte blob in the .data2 section), shows C2 host 217.156.8.148, port 43592, direct TCP transport (Tor and WebSocket options disabled), executable name backgroundTaskHost.exe, registry label backgroundTaskHost, client label client_1, retry base 5000 ms, and all persistence flags set to zero in this build. Additional modules are loaded either by direct in-memory mapping or by dropping a temporary DLL named dc[8-hex tick count][4-hex process id].dll, with attempted deletion after execution. An embedded DLL resource (resource 101) was also hashed.

Because the reverse proxy and session-cookie reuse make attacker access originate from the victim's own IP, sign-in IP reputation checks may not flag the unauthorized access. Defenders should revoke sessions, not just reset passwords. No CVE, CVSS score or threat-actor attribution is stated in the sources; severity is analyst-assigned.

## MITRE ATT&CK

- T1204.002 Malicious File
- T1059.003 Windows Command Shell
- T1553.005 Mark-of-the-Web Bypass
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1036.005 Match Legitimate Resource Name or Location
- T1620 Reflective Code Loading
- T1070.004 File Deletion
- T1539 Steal Web Session Cookie
- T1555.003 Credentials from Web Browsers
- T1219 Remote Access Tools
- T1090 Proxy
- T1571 Non-Standard Port
- T1095 Non-Application Layer Protocol

## Sources

- [New DarkCore RAT Targets Gmail and WhatsApp Sessions While Hiding Behind Victims' IP Addresses](https://cybersecuritynews.com/new-darkcore-rat/)
- [DarkCore: A Data Theft RAT with a Session-Hijacking Browser (BlackFog)](https://www.blackfog.com/darkcore-a-data-theft-rat-with-a-session-hijacking-browser/)
- [MITRE ATT&CK T1553.005 Subvert Trust Controls: Mark-of-the-Web Bypass](https://attack.mitre.org/techniques/T1553/005/)
- [MITRE ATT&CK T1539 Steal Web Session Cookie](https://attack.mitre.org/techniques/T1539/)
- [MITRE ATT&CK T1620 Reflective Code Loading](https://attack.mitre.org/techniques/T1620/)
- [MITRE ATT&CK T1219 Remote Access Software](https://attack.mitre.org/techniques/T1219/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4507