Threat researchers at BlackFog have published a technical breakdown of a newly surfaced Windows remote access trojan called DarkCore, built around a feature that makes it unusually difficult to spot through conventional means: a dedicated browser module that reuses stolen session cookies while routing the resulting traffic back through the victim’s own IP address.

Why Stealing a Live Session Beats Stealing a Password

A stolen password still requires an attacker to log in — and logging in from an unfamiliar device or location is exactly the kind of signal that triggers multi-factor authentication prompts and security alerts. A stolen session cookie skips that step entirely, since it represents a login that has already succeeded. DarkCore’s sales listing, which BlackFog traced to a marketplace posting from August 11, 2026, advertises exactly this capability: operators can inject stolen cookies for services like Gmail, WhatsApp, YouTube, and MediaFire directly into the malware’s own embedded browser and pick up the session as if they were the legitimate user.

The malware then goes a step further by proxying the resulting browser traffic through the infected device’s own internet connection, reportedly shutting the proxy down once the last associated browser window closes. BlackFog is careful to flag that some of these capabilities come from the seller’s own marketing material and promotional screenshots rather than fully independent verification of every feature — the team’s hands-on analysis confirmed the malware’s configuration structure and module-loading behavior, but didn’t test every advertised browser function line by line.

Either way, the implication for defenders is significant: a login that appears to originate from a victim’s familiar, previously trusted IP address is no longer reliable proof that the legitimate account owner is the one behind the keyboard. Investigators need corroborating endpoint evidence, not just network-level familiarity, before clearing suspicious account activity.

A Hidden Desktop, and a Decoy PDF That Isn’t One

Beyond session hijacking, DarkCore also advertises hidden virtual network computing (HVNC) — letting an operator interact with a browser session on the victim’s machine without any visible sign on the actual desktop the victim sees. Promotional material reviewed by BlackFog showed Chrome open to a live Gmail inbox through this hidden interface.

The delivery mechanism paired with the sample BlackFog obtained relies on a shortcut file disguised with a PDF icon, presenting itself as a document viewer. Opening it launches a minimized command window that performs two actions at once: it downloads a genuine, legitimate World Bank report to show the victim as a decoy, while separately and silently fetching the actual malicious executable. Notably, the launch command doesn’t verify that the executable download even succeeded before trying to run it, and the whole chain uses string-slicing and command obfuscation to make the underlying commands harder to read during casual inspection. Both downloads also attempt to strip the file’s Zone.Identifier marker — the flag Windows uses to warn users that a file came from the internet — reducing the chance of a security prompt appearing.

Under the Hood

The malware sample BlackFog obtained was an unsigned, 64-bit Windows executable. Reverse engineering its configuration required reconstructing a custom decoder that rotates through a 32-byte key and XORs it against a block of 758 encoded bytes. The recovered configuration in this particular sample had Tor and WebSocket communication options disabled in favor of direct TCP, and left startup-persistence flags unset — suggesting this specific build may have been a demo or limited-configuration copy rather than a fully weaponized deployment. Additional modules can be loaded either directly into memory or via temporary DLL files written to disk, giving operators flexibility in how much they leave behind on an infected system.

Detection and Response

BlackFog’s recommended detection approach focuses on correlating several signals rather than relying on any single indicator: unusual downloads initiated from command shells, suspicious process ancestry (a shortcut spawning a command interpreter, for instance), file-signature anomalies, and outbound network connections to unfamiliar infrastructure. Organizations that suspect a DarkCore infection are advised to:

• Isolate the affected endpoint immediately
• Preserve logs and forensic evidence before rebooting the machine
• Revoke and reissue session tokens for any accounts that may have been accessed
• Reset credentials for affected accounts, treating prior “trusted IP” activity with skepticism

DarkCore is a useful reminder that session-hijacking malware is increasingly designed around defeating the specific signals — device familiarity, IP reputation, recent login history — that security teams have come to rely on as shortcuts for trust.