MalwarePublished 27 Oct 2026

DarkCore: A Data-Theft RAT With a Session-Hijacking Browser

Source AlienVault OTX General

Description

DarkCore is a remote access trojan (RAT) that steals credentials and hijacks user sessions by reusing stolen session cookies to access services like Gmail and WhatsApp. It routes traffic through victims' IPs to mimic legitimate activity and includes hidden virtual network computing (HVNC) for stealthy desktop access. Distributed via PDF-themed shortcuts that deliver decoy documents alongside malware, DarkCore communicates with its command-and-control servers over TCP and can load additional modules dynamically.

Impact

DarkCore enables attackers to steal credentials and hijack active sessions on popular services, potentially leading to unauthorized access to sensitive accounts such as email and messaging platforms. Its ability to route traffic through victims' IP addresses helps evade detection by masquerading as legitimate user activity. The hidden VNC feature allows attackers to maintain stealthy remote desktop access, increasing the risk of prolonged compromise and data exfiltration.

Defensive guidance

No official patches or vendor advisories are available for DarkCore. Mitigation should focus on preventing infection by avoiding execution of suspicious PDF-themed shortcuts and verifying the legitimacy of downloaded executables. Endpoint detection and response solutions should be updated to detect the provided hashes and URLs associated with DarkCore. Network monitoring for unusual TCP connections to known command-and-control servers may help identify infections.

Summary

DarkCore is a sophisticated data-theft RAT discovered by security researchers. It features advanced credential theft and session hijacking capabilities, including a dedicated browser that reuses stolen session cookies to access multiple online services while masking activity by routing traffic through victims' IP addresses. The malware includes hidden VNC for concealed desktop control, credential managers displaying stolen usernames and passwords, and reverse proxy functionality. Distribution is via PDF-themed shortcuts that download decoy documents and malicious executables. The native C++ malware communicates with its command-and-control infrastructure using direct TCP connections and supports loading additional modules in-memory or as temporary DLL files to extend its capabilities.

Indicators of compromise

URLs 1

https://update.cdnlinks.org/ReportPDFReader.exe

Hashes 9

1782cd071bb973b3e24aa0ec49bc5a77
441a67671330483c53ab5fb9845c5b3a
2deedea02811bb8e288db1a96aac44bbfb533fd624b25f000823fa92baabd9a1
5102c02a158bd53649de66ecf627966f744e4fd46240523eb6cd11c348b2dfab
0530f78227fa92b7b2d716c6a8253405a83e4b9b4a0c84736f1a0863ff500925
38431ea1cd034fba9771c6c187a57657
1c88fc4bdbc144b341f46c5c1e7eae07422442bc
585cb5933db5a9209e663c66778dfff07669a8fe
bd47ddb17c2ffc579e7092515e628594efd8a762

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 27 Oct 2026, 15:28 UTC

MITRE ATT&CK techniques20 from threat tags

Technical details

Indicators of compromise

URLs 1

Hashes 9

Community reviews

Related threats