Illustrative image: Wikimedia Commons / Markus Spiske, CC0 — code on a developer's monitor. This is not a screenshot of DarkCore; the malware's own console images are seller marketing material and are not reproduced here.
TL;DR — DarkCore RAT Gmail WhatsApp session hijacking explained in one line: a newly analysed Windows trojan is sold with a browser that reuses your already-logged-in Gmail, WhatsApp, YouTube and MediaFire sessions, so an attacker can open your accounts without your password — and, the seller claims, without tripping login alerts, because the traffic comes from your own internet connection.
📌 KEY HIGHLIGHTS
- What it is: DarkCore, a native C++ Windows remote access trojan (RAT) found by BlackFog researchers on a cybercrime marketplace, listing dated 11 August 2026.
- The dangerous pitch: a dedicated browser that injects stolen session cookies and routes traffic through the victim's IP address, making account access look like the victim's own activity.
- Accounts named: Gmail, WhatsApp, YouTube and MediaFire appear in the seller's browser service list.
- How it arrives: a PDF-themed shortcut, PdfView.lnk, that shows a real World Bank report while quietly downloading an executable in the background.
- Honest caveat: BlackFog verified parts of the code but did NOT independently verify every advertised browser feature — the session-hijacking browser is, for now, a seller claim backed by screenshots, not a proven capability.
What happened?
During routine threat hunting, researchers at BlackFog, a security firm specialising in stopping data theft, found a new offering of DarkCore on a cybercrime network. What caught their attention was not the usual credential theft — it was the dedicated browser. The seller describes a browser built to reuse stolen browser sessions to reach work mailboxes, messaging apps, cloud storage and other services through the infected machine's own IP address, so the access looks like legitimate activity by the user.
BlackFog then compared the sales pitch with the actual code in a supplied Windows sample and an accompanying PDF-themed shortcut. That comparison is the most useful part of this story, because it separates what is proven from what is merely advertised — and for ordinary users, the lesson holds either way: a stolen session can be more valuable than a stolen password.
DarkCore RAT Gmail WhatsApp session hijacking explained: how the attack chain works
Here is the chain as BlackFog reconstructed it, step by step:
| Step | What happens | What is proven vs claimed |
|---|---|---|
| 1. The lure | A shortcut named PdfView.lnk, carrying a PDF icon and calling itself a "PDF Report Launcher", reaches the victim. How it is first distributed is still unknown. | Shortcut analysed by BlackFog |
| 2. The decoy | Opening it launches a minimised command window. Obfuscated curl commands download a genuine World Bank report as a distraction. | Commands reconstructed by BlackFog |
| 3. The payload | A second command downloads an executable, ReportPDFReader.exe, and runs it — even if the decoy PDF download fails. | Command confirmed; hosted file could not be hash-matched to the analysed sample |
| 4. Warning suppression | Both downloads have their Zone.Identifier stream stripped — the Windows marker for internet files — which can reduce security warnings. | Confirmed in the shortcut commands |
| 5. The foothold | The sample is an unsigned 64-bit Windows executable. Its settings point to a command-and-control server over direct TCP, borrow the name of the legitimate backgroundTaskHost process, and leave persistence flags off in this build. | Configuration recovered by BlackFog from the sample |
| 6. Session reuse | The operator picks a stolen session in the dedicated browser, which injects the cookies and routes traffic through the victim's IP. A hidden-desktop (HVNC) mode can also control a browser the user cannot see. | Advertised by the seller; NOT independently verified end-to-end by BlackFog |
One number doing the rounds needs correcting: the seller's credential-manager screenshot shows 118 rows of service URLs, usernames and passwords. BlackFog stresses that this is the seller's own screenshot, so it tells us nothing about how many victims have actually been compromised. Treat any report claiming "118 victims" as wrong.
Illustrative image: Wikimedia Commons / Florian Hirzinger, CC BY-SA 3.0 — a server room. This illustrates remote-access infrastructure, not DarkCore's systems.
Why your password and MFA may not be enough
When you sign in to Gmail or WhatsApp Web, your browser receives a session cookie — proof that a login already happened. Security checks like passwords and multi-factor authentication (MFA) guard the front door. But a valid session cookie skips the front door entirely: the service sees an already-authenticated session and lets it in without asking again. That is why session theft worries researchers more than password theft — and why BlackFog warns that a familiar sign-in IP address does not prove access was safe, since DarkCore's whole pitch is routing through the victim's own connection.
The defence follows from the same logic. If a device is suspected of infection, resetting the password alone is not enough: active sessions must be revoked too, so stolen cookies stop working. Google and WhatsApp both offer "sign out of all devices" / active-session controls, and that step matters more than a password change in a session-theft case. For high-value accounts, phishing-resistant authentication and device-bound sessions limit how far a stolen cookie can travel.
Why it matters for India readers
No Indian victim count and no India-specific advisory on DarkCore have been reported, and this post does not invent either. The India relevance is exposure: Gmail and WhatsApp are among the most-used services in the country, so a tool advertised to hijack exactly those sessions deserves attention here even before any local incident is confirmed. The same PDF-shortcut trick also travels well — a "report" attachment that opens a real document while installing malware in the background is exactly the kind of lure that works in busy inboxes.
For Indian readers, two habits matter most. First, be suspicious of unexpected .lnk shortcut files, even ones that open a genuine-looking PDF — a real document is the camouflage, not proof of safety. Second, check active sessions regularly: Gmail's account activity page and WhatsApp's linked-devices list show sessions you did not start, and signing out everywhere is the fastest way to kill a stolen session.
Should you care? ✅ / ⏳
✅ Yes, if you use Gmail or WhatsApp on a Windows PC — session hijacking is a real technique, this tool is actively marketed, and the delivery trick (a PDF decoy plus a hidden download) is easy to fall for. ⏳ Keep perspective: the flashiest claim — the session-reuse browser working exactly as advertised — is not yet independently proven, and no victim count exists. The threat is real; the hype around it should be discounted.
What to do if you suspect infection
BlackFog's detection advice centres on the earliest moments: a command window (cmd.exe) calling curl to download a document and an executable into temporary storage. For home users, the practical checklist is simpler: do not open unexpected shortcut files; keep Windows and your browser updated; if anything odd ran, isolate the PC from the network, sign out of Gmail and WhatsApp on all devices, revoke active sessions, then reset passwords; and check your mailbox and account activity for messages sent, files downloaded or settings changed that you did not make. Defenders should note the published indicators (defanged here so they cannot be clicked by accident): payload host update[.]cdnlinks[.]org, command server 217.156.8[.]148:43592, and temporary DLL files starting with "dc".
FAQs
What is DarkCore RAT? DarkCore is a Windows remote access trojan, advertised on a cybercrime marketplace since August 2026, that combines credential theft, file transfers, hidden desktop access and a dedicated browser for reusing stolen browser sessions. BlackFog analysed a supplied sample and its delivery shortcut in October 2026.
Can attackers really access Gmail and WhatsApp without a password? In principle, yes — if they hold a valid session cookie for an already-logged-in account, the service treats them as authenticated without a fresh password or MFA challenge. DarkCore's seller claims its browser does exactly this; BlackFog verified the surrounding code but has not independently proven the browser works as advertised.
Does multi-factor authentication protect against session hijacking? MFA protects the login step, not the session that follows it. Once an attacker holds a live session cookie, MFA is already behind them. That is why revoking active sessions, not just changing passwords, is the key response when compromise is suspected.
How does DarkCore spread? The analysed sample arrives via a shortcut file, PdfView.lnk, disguised as a PDF report launcher. It opens a real World Bank report as a decoy while downloading and running an executable in the background. The original distribution method — email, download or otherwise — is still unknown.
How do I know if my session was stolen? Look for signs you did not cause: messages sent from your accounts, files downloaded, settings changed, or unfamiliar devices in Gmail's account activity and WhatsApp's linked-devices list. A login from your own IP address is not proof of safety here, because DarkCore's advertised routing deliberately mimics the victim's connection.
TAKEAWAY: Passwords guard the login; sessions guard everything after it. DarkCore is a reminder to treat shortcut attachments with suspicion, review active sessions regularly, and — if anything looks wrong — sign out everywhere before you change a single password.
Follow World Tech on TechByCountry for tomorrow's update.
📸 Get tech in the last 24 hours on Instagram — follow @_techinlast24hrs for daily posts (9 AM–9 PM) and reels at 12:30 PM & 8:30 PM.
Sources
GBHackers — Hackers Can Use DarkCore RAT to Hijack Gmail and WhatsApp Sessions Without Passwords
Threadlinqs — DarkCore RAT Targets Gmail and WhatsApp (TL-2026-4507)
Related TechByCountry coverage: Gheist GitHub stolen-tokens campaign explained, PHP2Shell flaws added to CISA's exploited list, and UNM Health cyberattack diverts ambulances.
Comments
Post a Comment