Today, BlackFog released new research on DarkCore, a remote-access trojan (RAT) with a dedicated browser designed to hijack logged-in accounts, including Gmail and WhatsApp, while making the activity appear to come from the victim’s own IP address.
Attackers don’t need your password if they can access a session you’re already logged into. DarkCore’s advertised browser lets operators reuse stolen session cookies, potentially bypassing new login and MFA prompts. By routing traffic through the victim’s IP address, the activity can appear legitimate even when an attacker is in control.
BlackFog’s research team investigated DarkCore’s underground marketplace listing and analyzed a Windows malware sample, uncovering how a deceptive PDF-themed shortcut could deliver the threat.
What they found:
Stolen sessions can provide direct access to accounts without requiring a new login, potentially bypassing MFA. DarkCore’s advertised browser also allows attackers to disguise their activity by routing traffic through the victim’s IP address, making unauthorized access harder to detect.
The researchers also uncovered a fake PDF shortcut that opens a legitimate World Bank report while secretly downloading malware in the background. Once a device is compromised, DarkCore’s advertised hidden desktop functionality could allow attackers to control a browser without the victim seeing the activity.
The findings highlight a growing security challenge: a familiar device or IP address doesn’t necessarily mean the person accessing an account is legitimate.
Read the full research here.
Related
This entry was posted on October 22, 2026 at 9:48 am and is filed under Commentary with tags BlackFog. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
New Research Exposes DarkCore RAT That Hijacks Accounts Without Passwords
Today, BlackFog released new research on DarkCore, a remote-access trojan (RAT) with a dedicated browser designed to hijack logged-in accounts, including Gmail and WhatsApp, while making the activity appear to come from the victim’s own IP address.
Attackers don’t need your password if they can access a session you’re already logged into. DarkCore’s advertised browser lets operators reuse stolen session cookies, potentially bypassing new login and MFA prompts. By routing traffic through the victim’s IP address, the activity can appear legitimate even when an attacker is in control.
BlackFog’s research team investigated DarkCore’s underground marketplace listing and analyzed a Windows malware sample, uncovering how a deceptive PDF-themed shortcut could deliver the threat.
What they found:
Stolen sessions can provide direct access to accounts without requiring a new login, potentially bypassing MFA. DarkCore’s advertised browser also allows attackers to disguise their activity by routing traffic through the victim’s IP address, making unauthorized access harder to detect.
The researchers also uncovered a fake PDF shortcut that opens a legitimate World Bank report while secretly downloading malware in the background. Once a device is compromised, DarkCore’s advertised hidden desktop functionality could allow attackers to control a browser without the victim seeing the activity.
The findings highlight a growing security challenge: a familiar device or IP address doesn’t necessarily mean the person accessing an account is legitimate.
Read the full research here.
Share this:
Like this:
Related
This entry was posted on October 22, 2026 at 9:48 am and is filed under Commentary with tags BlackFog. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.