DarkCore Malware Bypasses Passwords via Hijacked Sessions
The trojan leverages stolen session cookies to grant unauthorized access to services like Gmail and WhatsApp.
Updated on Oct. 26, 2026 in Cybersecurity
Live Poll
Do you trust that your personal online accounts are secure from modern session-hijacking malware?
A remote access trojan named DarkCore is enabling attackers to bypass password requirements for Gmail and WhatsApp accounts. This malware captures and reuses stolen session cookies, allowing unauthorized access to private platforms.
Why it matters
By hijacking session cookies rather than credentials, this malware circumvents standard multi-factor authentication, posing a significant threat to session-based security models across web applications.
The malware uses a dedicated browser to reinject stolen session cookies, successfully bypassing typical password prompts. It further obscures its activity by using a reverse proxy to route traffic through the victim’s own IP address, simulating legitimate user behavior.
The players
DarkCore
A remote access trojan designed to hijack active web sessions by capturing and reusing session cookies.
Gmail
Google's web-based email platform currently targeted by session-hijacking attacks.
A widely used messaging platform vulnerable to unauthorized access through stolen session data.
The details
DarkCore operates by specifically targeting session cookies—small data files used by websites to remember a user’s logged-in status. When these are stolen, the malware loads them into its own embedded browser to trick the server into treating the attacker as the authenticated user. This approach is potent because it bypasses the password and second-factor checks typically required only during the initial sign-in process.
Timeline
October 26, 2026: The security findings regarding the DarkCore trojan were published.
The Tech Race
This malware highlights a growing trend of session-stealing attacks that effectively negate the protections offered by multi-factor authentication. Security architects are now racing to implement stricter session-binding policies to counteract this shift away from credential-based theft.
Users can mitigate session-hijacking risks by regularly clearing browser cookies and logging out of accounts on public or shared devices. Because this malware targets active sessions, keeping browser software updated remains a critical defense against the exploits that allow session injection.
The takeaway
DarkCore demonstrates that stolen session data can be as valuable as stolen passwords, effectively turning a browser into an authentication bypass tool. Security teams should monitor for the emergence of traffic routing through suspicious reverse proxies as a potential indicator of compromise.
Further reading
Learn more about evolving threat vectors in the Cybersecurity section.
Source note: This article includes information reported by IT Security News - cybersecurity, infosecurity news.
Live Poll
Do you trust that your personal online accounts are secure from modern session-hijacking malware?
