A remote access trojan, marketed with a dedicated browser, allows attackers to reuse stolen sessions while appearing to connect from victims' IP addresses. The trojan targets Gmail, WhatsApp, YouTube, and MediaFire, mimicking normal user activity to disguise account theft. The malware was listed on a cybercrime marketplace on August 11, 2026, with the seller promoting credential theft, file transfers, hidden desktop control, and reverse proxy capabilities.
DarkCore Exploits Authenticated Browser Sessions DarkCore's primary forte lies in its ability to manage authenticated browser sessions. Unlike relying solely on stolen passwords, operators can import session cookies that represent an existing login. Researchers examined a shortcut named PdfView.lnk, disguised as a PDF icon and described as "PDF Report Launcher."
Upon opening, it launches a minimized command window that employs obscured commands to download a legitimate World Bank report and a separate executable.
Researchers could not confirm if the remotely hosted payload matched their analyzed sample, and the shortcut’s original distribution method remains unknown. Additional modules can be loaded into memory or via temporary DLL files starting with “dc,” which the malware aims to delete after installation. Defenders should investigate cmd.exe launching curl to download PDFs and executables into temporary folders, correlating this activity with process ancestry and network connections.
Explore for your team.
