Cybersecurity threats target Gmail, WhatsApp, and Telegram users

Security researchers have identified new malware threats capable of bypassing advanced security measures on popular communication platforms.

The DarkCore malware, a remote access trojan (RAT) written in C++, utilizes session hijacking to access services like Gmail, WhatsApp, and MediaFire. Instead of requiring passwords, the malware reuses authenticated session cookies, allowing attackers to bypass multi-factor authentication. It also employs a reverse proxy to route unauthorized traffic through the victim's IP address, making malicious activity appear legitimate. Additionally, it uses hidden virtual network computing (HVNC) to control browsers within a hidden Windows desktop environment.

Separately, a spyware known as uCreator has been discovered targeting Android users. Distributed via modified APK files outside official app stores, this malware can intercept Telegram's two-step verification passwords as they are typed. This allows criminals to take full control of accounts, view chat histories, change linked phone numbers, and delete profiles. The spyware also includes tools for cloning WeChat accounts using a virtual environment called Onion Box.