Xakerlar Gmail va WhatsApp sessiyalarini parolsiz egallash uchun DarkCore RAT'dan foydalanishi mumkin

DarkCore — bu o'g'irlangan sessiyalarni qayta ishlatish uchun maxsus brauzer bilan reklama qilinadigan masofaviy kirish troyani bo'lib, u hujumchilarga Gmail, WhatsApp va MediaFire'ga parolsiz kirish imkonini berishi mumkin.

Uning reklama qilingan teskari proksi qurilmaning IP manzili orqali trafikni yo'naltiradi, bu esa ruxsatsiz faoliyatni jabrlanuvchining qonuniy kirishiga o'xshatadi.

Topilmalar kiberjinoyat bozori e'loni, Windows bajariladigan fayl tahlili va zararli yorliq bilan birlashtirilgan.

Muhim jihat shundaki, tadqiqotchilar zararli dastur komponentlarini tasdiqladilar, ammo reklama qilingan brauzer imkoniyatlarining barchasi ishlashini aniqlamadilar.

2026-yil 11-avgustdagi ro'yxat DarkCore'ni mahalliy C++ implant sifatida tasvirlaydi, u ma'lumot o'g'irlash, fayl uzatish, yashirin ish stoli nazorati va teskari proksi funksiyalarini qo'llab-quvvatlaydi.

Sotuvchi skrinshotida 118 ta ma'lumot qatori ko'rsatilgan, ammo bu yozuvlar jabrlangan qurbonlar sonini aniqlamaydi.

DarkCore bozori ro'yxati (Manba: BlackFog).

Asosiy tahdid — sessiya o'g'irlash. Yangi kirish o'rniga, hujumchi autentifikatsiyalangan sessiyani ifodalovchi cookie fayllarini qayta ishlatadi.

Microsoft hujjatlashtirganidek, o'g'irlangan sessiya cookie fayllari hujumchilarga ko'p faktorli autentifikatsiya allaqachon bajarilgandan keyin foydalanuvchilarni taqlid qilish imkonini beradi.

BlackFog xavfsizlik tadqiqotchilari DarkCore'ni aniqladilar; reklama qilingan brauzer WhatsApp, YouTube, Gmail va MediaFire'ni ro'yxatga oladi. Uning o'zgarish jurnaliga ko'ra, operatorlar o'g'irlangan cookie fayllarini kiritishi va jabrlanuvchining tarmoq ulanishi orqali ko'rishi mumkin.

DarkCore RAT sessiyasi

Alohida, yashirin virtual tarmoq hisoblash (HVNC) yashirin Windows ish stolida ishlaydigan brauzerni nazorat qilishni ta'minlaydi.

Sotuvchi tasvirlari Gmail'ni ushbu interfeys orqali ochiq ko'rsatadi. Ikkala yondashuv ham yakuniy nuqtada mavjud bo'lishni talab qiladi, bu xizmatlardagi yangi aniqlangan zaiflikni ishlatish emas.

DarkCore brauzeri va xizmatlar ro'yxati, shaxsiy kontent qizil rangda (Manba: BlackFog).

PdfView.lnk yorlig'i "PDF Hisobot Ishga Tushirgichi" sifatida niqoblanadi va PDF belgisini ishlatadi.

Uni ishga tushirish minimallashtirilgan buyruq oynasini ochadi, u qonuniy Jahon Banki hisobotini va bajariladigan faylni yuklab oladi.

Uning buyruqlari curl.exe va START'ni satr kesish, belgilarni olib tashlash va CALL kengaytmasi orqali yashiradi.

Dekoy vaqtinchalik PDF sifatida ochiladi, alohida buyruq esa ReportPDFReader.exe'ni update[.]cdnlinks[.]org'dan oladi.

Har qanday faylni ishga tushirishdan oldin, yorliq Zone.Identifier muqobil ma'lumot oqimini o'chirishga urinadi, bu esa yuklab olish bilan bog'liq ogohlantirishlarni kamaytirishi mumkin.

Operatsiyalar mustaqil: hujjatni olishda muvaffaqiyatsizlik yukni yuklab olish urinishini to'xtatmaydi.

Tadqiqotchilar masofadan joylashgan bajariladigan fayl ularning tahlil qilingan namunasi bilan mos kelishini tasdiqlay olmadilar. Yorliqning asl tarqatish usuli ham noma'lum qolmoqda.

Imzolanmagan, 64-bitli Windows namunasi DARKCORE01 belgisini va masofaviy ish stoli va HVNC bilan bog'liq interfeyslarni o'z ichiga oladi.

Gmail DarkCore HVNC interfeysi orqali ko'rsatilgan (Manba: BlackFog).

Tadqiqotchilar uning konfiguratsiyasini kalit baytlarini aylantiradigan va .data2 bo'limidagi 758 baytni XOR bilan shifrlaydigan dekoderni teskari muhandislik qilish orqali tikladilar.

Tiklangan sozlamalar 217.156.8[.]148:43592 bilan to'g'ridan-to'g'ri TCP aloqasini belgilaydi. Tor va WebSocket variantlari o'chirilgan.

Nomlash maydonlari backgroundTaskHost.exe va backgroundTaskHost'dan foydalanadi, bu qonuniy Windows jarayonini taqlid qiladi, ammo ushbu qurilishda o'rnatish va ishga tushirish doimiyligi bayroqlari o'chirilgan.

Qo'shimcha modullar xotiraga xaritalanishi yoki DLL sifatida yozilishi mumkin, keyin yuklanadi. Diskka asoslangan yo'l "dc" bilan boshlanadigan fayl nomlarini yaratadi, ularni LoadLibraryA orqali yuklaydi, so'ngra o'chirishga urinadi.

Kengroq dars shundaki, faqat parol himoyasi autentifikatsiyalangan sessiya buzilishini cheklay olmaydi. Microsoft buzilgan sessiyalarni bekor qilishni, ma'lumotlarni qayta tiklashni va hujumchi o'zgarishlarini tekshirishni tavsiya qiladi.

Ushbu tekshiruv uchun himoyachilar yorliq bajarilishini, shubhali curl yuklab olishlarini, tiklangan buyruq va nazorat yakuniy nuqtasini va vaqtinchalik DLL faoliyatini korrelyatsiya qilishlari kerak, reklama qilingan hisob o'g'irlash funksiyalarini mustaqil ravishda tasdiqlangan natijalar emas, balki qo'shimcha tasdiqlashni talab qiladigan da'volar sifatida ko'rib chiqishlari kerak.

Buzilish ko'rsatkichlari

Eslatma: IP manzillar va domenlar tasodifiy hal qilish yoki giperhavola qilishni oldini olish uchun ataylab defang qilingan (masalan, [.]). Faqat MISP, VirusTotal yoki SIEM kabi nazorat qilinadigan tahdid razvedka platformalarida qayta fang qiling.

DarkCore, a remote access trojan marketed with a dedicated browser for reusing stolen sessions, potentially letting attackers access Gmail, WhatsApp, and MediaFire without entering passwords.

Its advertised reverse proxy routes traffic through the infected device’s IP address, making unauthorized activity resemble legitimate access from the victim.

The findings combine a cybercrime marketplace advertisement with analysis of a Windows executable and an accompanying malicious shortcut.

Crucially, researchers verified components of the malware, but did not establish that every advertised browser capability works.

A listing dated August 11, 2026, describes DarkCore as a native C++ implant supporting credential theft, file transfers, hidden desktop control and reverse proxying.

A seller screenshot displayed 118 credential rows, although these entries do not establish the number of compromised victims.

DarkCore’s marketplace listing (Source : BlackFog).

The central threat is session hijacking. Rather than completing a fresh login, an attacker reuses cookies representing an authenticated session.

Microsoft has documented how stolen session cookies can let attackers impersonate users after multifactor authentication has already been satisfied.

BlackFog security researchers uncovered DarkCore, advertised browser lists WhatsApp, YouTube, Gmail and MediaFire. According to its changelog, operators can inject stolen cookies and browse through the victim’s network connection.

DarkCore RAT Session

Separately, hidden virtual network computing, or HVNC, provides control of a browser running on a concealed Windows desktop.

Seller imagery shows Gmail open through this interface. Both approaches require an existing foothold on the endpoint, rather than exploiting a newly identified vulnerability in those services.

DarkCore’s browser and service list, with private content redacted (Source : BlackFog).

The accompanying PdfView.lnk shortcut masquerades as a “PDF Report Launcher” and uses a PDF icon.

Launching it opens a minimized command window that downloads a legitimate World Bank report alongside an executable.

Its commands conceal curl.exe and START through string slicing, character removal and CALL expansion.

The decoy opens as a temporary PDF while a separate command retrieves ReportPDFReader.exe from update[.]cdnlinks[.]org.

Before launching either file, the shortcut attempts to delete its Zone.Identifier alternate data stream, potentially reducing download-related warnings.

The operations are independent: failure to retrieve the document does not prevent the payload download attempt.

Researchers could not verify whether the remotely hosted executable matched their analyzed sample. The shortcut’s original distribution method also remains unknown.

The unsigned, 64-bit Windows sample contains the DARKCORE01 marker and interfaces associated with remote desktop and HVNC.

Gmail displayed through DarkCore’s HVNC interface (Source : BlackFog).

Researchers recovered its configuration by reversing a decoder that rotates key bytes and XORs 758 bytes in the .data2 section.

The recovered settings specify direct TCP communication with 217.156.8[.]148:43592. Tor and WebSocket options are disabled.

Naming fields use backgroundTaskHost.exe and backgroundTaskHost, imitating a legitimate Windows process, although installation and startup persistence flags are disabled in this build.

Additional modules can be mapped into memory or written as DLLs before loading. The disk-based path creates filenames beginning with “dc,” loads them through LoadLibraryA, then attempts deletion.

The wider lesson is that password protection alone cannot contain an authenticated-session compromise. Microsoft recommends revoking compromised sessions alongside resetting credentials and investigating attacker changes.

For this investigation, defenders should correlate shortcut execution, suspicious curl downloads, the recovered command-and-control endpoint and transient DLL activity, while treating the advertised account-hijacking functions as claims requiring further validation rather than independently demonstrated outcomes.

Indicators of Compromise

Note:IP addresses and domains are intentionally defanged (e.g.,[.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.