#remoteaccesstrojan

Read Time:3 Minute, 42 Second

Threat researchers at BlackFog have published a technical breakdown of a newly surfaced Windows remote access trojan called DarkCore, built around a feature that makes it unusually difficult to spot through conventional means: a dedicated browser module that reuses stolen session cookies while routing the resulting traffic back through the victim’s own IP address.

Why Stealing a Live Session Beats Stealing a PasswordA stolen password still requires an attacker to log in — and logging in from an unfamiliar device or location is exactly the kind of signal that triggers multi-factor authentication prompts and security alerts. A stolen session cookie skips that step entirely, since it represents a login that has already succeeded. DarkCore’s sales listing, which BlackFog traced to a marketplace posting from August 11, 2026, advertises exactly this capability: operators can inject stolen cookies for services like Gmail, WhatsApp, YouTube, and MediaFire directly into the malware’s own embedded browser and pick up the session as if they were the legitimate user.

The malware then goes a step further by proxying the resulting browser traffic through the infected device’s own internet connection, reportedly shutting the proxy down once the last associated browser window closes. BlackFog is careful to flag that some of these capabilities come from the seller’s own marketing material and promotional screenshots rather than fully independent verification of every feature — the team’s hands-on analysis confirmed the malware’s configuration structure and module-loading behavior, but didn’t test every advertised browser function line by line.

Either way, the implication for defenders is significant: a login that appears to originate from a victim’s familiar, previously trusted IP address is no longer reliable proof that the legitimate account owner is the one behind the keyboard. Investigators need corroborating endpoint evidence, not just network-level familiarity, before clearing suspicious account activity.

A Hidden Desktop, and a Decoy PDF That Isn’t OneBeyond session hijacking, DarkCore also advertises hidden virtual network computing (HVNC) — letting an operator interact with a browser session on the victim’s machine without any visible sign on the actual desktop the victim sees. Promotional material reviewed by BlackFog showed Chrome open to a live Gmail inbox through this hidden interface.

The delivery mechanism paired with the sample BlackFog obtained relies on a shortcut file disguised with a PDF icon, presenting itself as a document viewer. Opening it launches a minimized command window that performs two actions at once: it downloads a genuine, legitimate World Bank report to show the victim as a decoy, while separately and silently fetching the actual malicious executable. Notably, the launch command doesn’t verify that the executable download even succeeded before trying to run it, and the whole chain uses string-slicing and command obfuscation to make the underlying commands harder to read during casual inspection. Both downloads also attempt to strip the file’s Zone.Identifier marker — the flag Windows uses to warn users that a file came from the internet — reducing the chance of a security prompt appearing.

Under the HoodThe malware sample BlackFog obtained was an unsigned, 64-bit Windows executable. Reverse engineering its configuration required reconstructing a custom decoder that rotates through a 32-byte key and XORs it against a block of 758 encoded bytes. The recovered configuration in this particular sample had Tor and WebSocket communication options disabled in favor of direct TCP, and left startup-persistence flags unset — suggesting this specific build may have been a demo or limited-configuration copy rather than a fully weaponized deployment. Additional modules can be loaded either directly into memory or via temporary DLL files written to disk, giving operators flexibility in how much they leave behind on an infected system.

Detection and ResponseBlackFog’s recommended detection approach focuses on correlating several signals rather than relying on any single indicator: unusual downloads initiated from command shells, suspicious process ancestry (a shortcut spawning a command interpreter, for instance), file-signature anomalies, and outbound network connections to unfamiliar infrastructure. Organizations that suspect a DarkCore infection are advised to:

Isolate the affected endpoint immediately

Preserve logs and forensic evidence before rebooting the machine

Revoke and reissue session tokens for any accounts that may have been accessed

Reset credentials for affected accounts, treating prior “trusted IP” activity with skepticism

DarkCore is a useful reminder that session-hijacking malware is increasingly designed around defeating the specific signals — device familiarity, IP reputation, recent login history — that security teams have come to rely on as shortcuts for trust.

Read Time:4 Minute, 25 Second

The threat actor behind one of the most widely used information-stealing tools of the past few years is back in business. Researchers at Varonis Threat Labs have identified a new remote access trojan called Stadia, advertised on underground forums starting October 16, 2026, that they say was built by the same seller responsible for StealC.

Rebuilding After a TakedownThe comeback follows a significant law enforcement setback for the StealC operation. As part of the broader Operation Endgame crackdown in June 2026, authorities seized 326 servers and 142 domains tied to the malware-as-a-service operation, according to Varonis. That kind of infrastructure seizure typically sets a criminal operation back substantially, cutting off command-and-control channels and customer access overnight.

Rather than disappearing, the seller — who signs posts under the handle “plymouth” — appears to have used surviving code from the StealC project as the foundation for a rebrand. Varonis researchers obtained a build of the new tool, examined its code, and tested its web management panel against one of their own Windows machines to confirm the connection. The clearest piece of evidence: an embedded browser-encryption helper component that matches StealC version 3.5’s equivalent module byte for byte, a level of code reuse that leaves little doubt about shared authorship.

Six Modules, One SubscriptionWhere StealC focused primarily on harvesting stored credentials and data, Stadia expands the toolkit considerably. The malware bundles six separate capabilities: a traditional data-stealing module, a hidden virtual network computing (HVNC) component for covert remote desktop access, a remote command shell, a malware loader for fetching additional payloads, a file explorer, and a process manager.

The HVNC feature is particularly notable. It lets a criminal operator work inside a separate, invisible desktop session on the victim’s machine — browsing files, running programs, or manipulating settings — without the victim noticing anything unusual happening on their own screen. Combined with file upload, download, and execution capabilities, it effectively gives a buyer full hands-on-keyboard access to an infected PC, not just a one-time credential dump.

On the data-theft side, the seller advertises collection capability spanning more than 50 web browsers, roughly 120 cryptocurrency wallet browser extensions, and around 50 standalone desktop crypto wallets, in addition to messaging apps, gaming platform sessions, email clients, and VPN client credentials.

Pricing follows a tiered subscription model common among modern malware-as-a-service offerings: $300 a month for a Basic tier, $550 for a Team tier, and $900 for the top Pro tier, which is the only package that unlocks all six modules. In a customer-retention move that doubles as evidence of the rebrand’s intent, former StealC subscribers are being offered a free month of the Pro tier — a clear effort to migrate the old customer base onto the new platform.

Built to Evade, Built to HideTechnically, the sample Varonis examined is an unsigned, 32-bit Windows executable roughly 560 kilobytes in size, compiled with Microsoft Visual C++. It conceals sensitive internal strings using a combination of RC4 encryption and Base64 encoding, and resolves most of the Windows API functions it needs only at runtime, a common technique for frustrating static analysis.

The malware also checks the system’s language settings and will refuse to run if it detects Russian, Ukrainian, Belarusian, Kazakh, or Uzbek configurations — a pattern frequently seen in malware believed to originate from the former Soviet cybercrime ecosystem, where operators avoid infecting machines in their own geographic “home turf.”

Once installed, Stadia drops itself into a randomly named folder under Windows’ shared application-data directory, disguising its executable with a filename designed to resemble legitimate system software. It establishes persistence through a hidden scheduled task that triggers at user logon and then repeats every 15 minutes. When it manages to run with elevated privileges, it goes a step further and uses PowerShell to add its own installation folder to Microsoft Defender’s exclusion list, shielding itself from the built-in antivirus scanner.

For browser credential theft specifically, Stadia launches an unsigned helper process that starts Chrome, Edge, or Brave in a suspended state and injects roughly 26 kilobytes of code into it to extract the browser’s internal encryption key — briefly writing that key out to a temporary text file before deleting it. Network communication with its command-and-control servers uses plain HTTP requests disguised to look like JSON, but the payload inside is actually RC4-encrypted and Base64-encoded data.

Detection Over BlocklistsVaronis cautions that the specific server addresses and encryption keys change from build to build, meaning static indicators like IP addresses or hashes have a short shelf life. The firm recommends defenders instead focus on behavioral signals: unexpected browser process injection, newly created hidden scheduled tasks, unexplained Defender exclusion changes, and HTTP traffic claiming to be JSON that doesn’t actually parse as such.

Notably, the published research does not establish how Stadia is initially delivered to victims — whether through phishing, malicious ads, cracked software, or another vector — nor does it provide an independently verified count of current infections. For now, the clearest lesson is one familiar from the broader malware-as-a-service economy: dismantling infrastructure disrupts an operation, but when the underlying code and the seller’s customer relationships survive, a rebrand can bring the business back online within months.