MedusaHVNC Malware Uses Hidden Windows Desktops to Evade Detection

Summary

MedusaHVNC, a malware-as-a-service offering, employs a hidden virtual network computing (HVNC) module to operate within an invisible Windows desktop. This allows attackers to maintain persistent, covert remote access, launching legitimate browsers and utilizing Windows functions without user detection. The malware employs a multi-stage infection chain involving JScript, AutoIT, and multiple encryption layers before establishing communication with its hardcoded command and control server.

Full text

Hidden desktops are a legitimate Windows capability, often used by specialized software, and occasionally used by malware. MedusaHVNC is a remote access trojan (RAT) being sold as malware-as-a-service (MaaS). It is promoted through its own website and a Telegram channel. It was found and analyzed by BlackFog, with the analysis finding a hidden virtual network computing (HVNC) module that opens a legitimate browser on a separate hidden Windows desktop, Since it operates from a hidden desktop, its operation is invisible to the user. The malware uses a 5-stage infection chain. It starts when the legitimate wscript.exe executes a JScript launcher. The script waits for just over 7.5 seconds and then builds its embedded files under %TEMP%\Nx2981Okkr2\. Several files are written to disc, including an encrypted payload and a .bat in the Startup folder to maintain persistence. Windows AutoIT is used to decrypt the payload and start charmap.exe (the Windows character map utility. The loader, now inside charmap.exe, contains two further layers of encryption. “The first applies a 16-byte repeating XOR operation to 1,009,152 bytes from the .data section. The second uses ChaCha20 to decrypt 998,912 bytes of ciphertext with a 32-byte key, a 12-byte nonce, and an initial counter value of 1,” write the researchers.Advertisement. Scroll to continue reading. That installed final payload ‘is an unsigned PE32+ x86-64 console executable containing a .pay section and the family string MedusaHVNC.’ It communicates with the operator’s C2 at a hardcoded address: 51.89.204.28:4444. The operator can create a browser of choice within the hidden desktop from Chrome, Edge, and Firefox. Legitimate Windows functions, including BitBlt, EnumWindows, and PrintWindow support screen and window capture, while SendInput and SetWindowsHookExW are associated with synthetic input and interaction. “Clipboard functions, including OpenClipboard, GetClipboardData, and SetClipboardData, provide another way to move information into or out of the session,” comment the researchers. The hidden desktop allows the attacker to take full advantage of legitimate Windows tools without being observed by the user. The C2 is hardcoded into the malware but is relatively safe from observation. The result is a stealthy and persistent RAT. The only obvious mitigation is detection of unexpected data exfiltration. Even if the RAT’s operation is out of view in the unknown and hidden desktop, the data must still be exfiltrated from the network. Detection of unexplained data leaving the network is always an indication that something is wrong somewhere. Related: Google Antigravity in Crosshairs of Security Researchers, Cybercriminals Related: Threat Actor Infests Hotels With New RAT Related: New ‘Lobshot’ hVNC Malware Used by Russian Cybercriminals Related: TrickBot Targets Outlook, Browser Data Written By Kevin Townsend Kevin Townsend is a Senior Contributor at SecurityWeek. He has been writing about high tech issues since before the birth of Microsoft. For the last 15 years he has specialized in information security; and has had many thousands of articles published in dozens of different magazines – from The Times and the Financial Times to current and long-gone computer magazines. Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights. More from Kevin Townsend OpenAI Fixes ChatGPT Agent Flaw That Could Let Attackers Forge an AI InsiderVibe-Coded Apps Riddled With Exploitable Security FlawsCisco Launches Low-Cost AI Models for Source Code SecurityCISO Conversations: Andreas Gaetje – From Economics to CISO at Körber AGAI Data Centers Are Being Built Faster Than They Can Be SecuredWindows Bind Link Attacks Can Hide Malware From EDR ToolsHacker Conversations: Jesse McGraw (GhostExodus), From Blackhat Hacker to RedemptionUK Government Rolls Out Agentic AI Defense Plan Alongside Industry Pledge Latest News PTC Windchill Vulnerability Exploited in Ransomware CampaignNvidia and Tech Giants Launch AI Security AllianceCoca-Cola Confirms Data Breach After Fairlife Ransomware AttackBeelzebub Raises $3.4 Million for Hacker-Trapping PlatformWhat’s Hiding in Your Mobile Apps? Lookout MSEC Aims to Find OutHacked Public Wi-Fi Gateways Used to Harvest Corporate CredentialsAnthropic’s Opus 5 Nears Mythos 5 on Finding Bugs, but Falls Short on ExploitsDentaQuest Data Breach Potentially Impacts Over 23 Million People Trending Daily Briefing NewsletterSubscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Webinar: Closing the Exploitation Gap July 22, 2026 Join this live webinar as we explore why exploitation is outpacing remediation, where risk is growing fastest, and what security leaders can do to close the gap before attackers take advantage. Register Virtual Event: CodeSecCon 2026 August 19, 2026 CodeSecCon bridges the gap between dev and security. Discover best practices for secure coding, innovative risk-reduction tools, and safe AI integration to cultivate a true DevSecOps culture. Safely secure your apps! Register People on the MoveBarry Childe has joined data sciences tech company Datavault AI as Chief Information Security Officer.John DeSimone, the former CEO of Nightwing, has been named Chief Operating Officer at Everfox.Sectigo has appointed Prem Hareesh as Corporate Chief Technology Officer.More People On The MoveExpert Insights Is Patching Dead? Vulnerability Management in the Post-Mythos Era You cannot out-patch a machine that writes a working exploit from a vulnerability description in twenty hours. Stop trying to optimize a game you cannot win. (Danelle Au) When Identity Verification Fails: Lessons from a Real-World SIM Swap and Near Account Takeover Identity confidence changes throughout every interaction and should be reassessed continuously as new risk signals emerge. (Torsten George) Legacy Systems, Real-World Impacts: The Reality of OT Security Legacy systems, safety concerns, and critical infrastructure risks make OT vulnerability disclosure one of cybersecurity's most challenging balancing acts. (Tod Beardsley) The Shift Toward Business-Aligned Risk Management Moving from isolated, technical data to a continuous risk lifecycle can help organizations align security controls with actual business consequences. (Steve Durbin) How to Conduct a Successful Audit of AI-Driven Software Development As AI-generated code becomes commonplace, CISOs need new audit strategies to measure developer practices, govern AI tool usage, and identify software risks before they reach production. (Matias Madou) Flipboard Reddit Whatsapp Whatsapp Email

Indicators of Compromise

• ip — 51.89.204.28
• malware — MedusaHVNC

Entities