DarkCore RAT: New Research Into Credential Theft and Stolen Browser Sessions

DarkCore RAT is a Windows-based malware tool sold on cybercrime forums that enables attackers to steal credentials, hijack authenticated browser sessions, and control victim machines via hidden desktop access (HVNC). Its dedicated browser imports stolen session cookies and routes traffic through the victim's IP to evade detection. The malware is deployed using a PDF-themed shortcut that downloads a legitimate-looking report alongside a malicious executable, which is obfuscated to avoid user suspicion. The RAT communicates with a fixed C2 server over direct TCP and can load additional modules either in memory or as DLLs on disk. Persistence mechanisms appear disabled in the analyzed sample, but operators have control over session reuse and remote access features. Indicators of compromise and detailed analysis are provided by BlackFog researchers.

DarkCore enables attackers to steal user credentials and hijack authenticated sessions, potentially granting unauthorized access to email, messaging, and cloud storage accounts. The session hijacking feature allows attackers to appear as legitimate users by routing traffic through victims' IP addresses, complicating detection. Hidden desktop access allows full remote control of infected machines without user awareness. These capabilities can lead to data theft, privacy breaches, and further compromise of connected services.

No official patch or remediation is currently available for DarkCore RAT. Mitigation should focus on preventing initial infection vectors, such as avoiding execution of suspicious shortcuts and executables. Endpoint detection solutions should be updated to detect indicators of compromise associated with DarkCore. Network monitoring for unusual outbound connections to the identified C2 IP (217.156.8.148) and port (43592) may help identify infections. Users should be cautious of unexpected PDF reports or similar decoys that may deliver malware. Follow vendor advisories and threat intelligence updates for any future remediation guidance.