Threat reportMalwareTL-2026-1723
MedusaHVNC: Malware-as-a-Service RAT Uses Hidden Desktop (hVNC) to Hijack Live Browser Sessions and Steal Credentials
MedusaHVNC: Malware-as-a-Service RAT Uses Hidden Desktop (TL-2026-1723) is a high-severity malware campaign, first published 2026-07-27. It has no confirmed attribution, affects Microsoft Windows (workstation/server, JScript/WSH + charmap.exe, maps to 22 MITRE ATT&CK techniques (T1010, T1021, T1027), and is covered by 9 detection rules and 28 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 22MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 28Indicators of compromise
Key facts for TL-2026-1723
- Threat ID
- TL-2026-1723
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- financial services, banking, cryptocurrency
- Detection rules
- 9
- Indicators of compromise
- 28
Malware and tooling in MedusaHVNC: Malware-as-a-Service RAT Uses Hidden Desktop
Malware and tooling: DarkVNC, MedusaHVNC, Pandora hVNC, Venom RAT, XWorm, XenoRAT, AutoIt (abused interpreter), Windows Script Host (wscript.exe / JScript)
How MedusaHVNC: Malware-as-a-Service RAT Uses Hidden Desktop works
MedusaHVNC is a Malware-as-a-Service remote access trojan that opens a real browser on a completely hidden Windows desktop, letting operators ride the victim's already-authenticated Chrome, Edge, Brave, Firefox, and Telegram sessions while silently extracting passwords, cookies, and browsing history. It runs .NET/native payloads entirely in memory behind AMSI/ETW bypasses and communicates with a hardcoded C2 (51.89.204.28:4444) after a five-stage obfuscated infection chain.
MedusaHVNC is a commercially distributed remote access trojan (RAT) sold as Malware-as-a-Service (MaaS) through a dedicated storefront and a Telegram marketing channel. Its defining capability is a hidden Virtual Network Computing (hVNC) module: rather than exploiting a vulnerability, the implant spins up an entirely separate Windows desktop session complete with its own explorer.exe process, invisible to the logged-in user, and launches a real instance of the victim's browser on it. Because that browser loads the victim's actual profile, saved sessions, and cookies, any activity the operator performs — logging into a bank portal, moving cryptocurrency, or authorizing a transaction — appears to originate from the victim's own trusted, already-authenticated device, defeating device- and location-based anti-fraud checks used by financial institutions.
Delivery and execution follow a documented five-stage chain: (1) Windows Script Host runs an obfuscated JScript launcher that sleeps ~7,584ms as a sandbox/time-based evasion measure before staging further components into a temporary working folder (observed as Temp\Nx2981Okkr2); (2) the launcher drops a legitimate AutoIt interpreter, configuration data, and an encrypted payload, and installs a Startup-folder entry for persistence; (3) the AutoIt interpreter decrypts the first native-stage payload using a single-byte XOR key (0xAE); (4) that stage injects into charmap.exe (the built-in Windows Character Map utility) via process hollowing, giving the malware a trusted-looking parent process; (5) the hollowed process unpacks the true final payload through two further obfuscation layers — a 16-byte repeating XOR pass over roughly 1MB of data followed by ChaCha20 decryption (32-byte key, 12-byte nonce, counter value 1). The recovered final artifact is an unsigned PE32+ x86-64 console executable containing a distinguishing '.pay' section and an embedded family identifier string.
Once running, MedusaHVNC advertises a 'Mem Exec' capability that executes .NET and native payloads entirely in memory while patching AMSI and disabling/bypassing ETW, minimizing on-disk and telemetry footprint. It abuses legitimate Windows APIs to operate the hidden desktop and steal data: BitBlt, EnumWindows, and PrintWindow for screen capture and window enumeration; SendInput and SetWindowsHookExW to drive synthetic mouse/keyboard input into the hidden browser session; and OpenClipboard/GetClipboardData/SetClipboardData for clipboard access (useful for both data theft and clipboard-swap fraud such as cryptocurrency address substitution). A 'Browser Recovery' module additionally extracts saved passwords, cookies, and browsing history directly from Chrome, Edge, Brave, Firefox, and the Telegram desktop client. All observed C2 traffic uses a custom protocol over raw TCP sockets to a single hardcoded IP:port (51.89.204.28:4444) rather than dynamic DNS resolution or an HTTP(S)-based channel, making network egress filtering to that IP an effective, if narrow, mitigation.
MedusaHVNC's architecture mirrors a broader lineage of hVNC/hRDP-capable commodity RATs marketed to cybercriminals (e.g., DarkVNC, Venom RAT, XWorm, Pandora hVNC, Xeno RAT) that have long been used in banking-fraud and account-takeover operations; MedusaHVNC packages the same hidden-desktop session-riding technique with modern in-memory execution and AMSI/ETW evasion for affiliate-model resale. Because it is a MaaS toolkit rather than a single campaign, it is expected to be deployed by multiple, financially motivated affiliates rather than one attributable actor.
MITRE ATT&CK techniques used in TL-2026-1723
Discovery
T1010 Application Window Discovery
Lateral Movement
Defense Evasion
T1027 Obfuscated Files or Information; T1055 Process Injection; T1140 Deobfuscate/Decode Files or Information; T1218 System Binary Proxy Execution; T1497 Virtualization/Sandbox Evasion; T1564 Hide Artifacts; T1620 Reflective Code Loading
Exfiltration
T1041 Exfiltration Over C2 Channel
Privilege Escalation
Execution
T1059 Command and Scripting Interpreter; T1106 Native API
Command and Control
T1095 Non-Application Layer Protocol; T1571 Non-Standard Port
Collection
T1113 Screen Capture; T1115 Clipboard Data
collection
T1185 Browser Session Hijacking
execution
Credential Access
T1539 Steal Web Session Cookie; T1555 Credentials from Password Stores
Persistence
T1547 Boot or Logon Autostart Execution
defense-impairment
Affected products and versions in MedusaHVNC: Malware-as-a-Service RAT Uses Hidden Desktop
- Microsoft — Windows (workstation/server, JScript/WSH + charmap.exe present)
Vulnerable versions: Windows 10; Windows 11; Windows Server builds with Windows Script Host enabled - Google — Chrome
Vulnerable versions: all versions (session/credential theft via hVNC, not a Chrome vulnerability) - Microsoft — Edge
Vulnerable versions: all versions (session/credential theft via hVNC, not an Edge vulnerability) - Brave Software — Brave Browser
Vulnerable versions: all versions (session/credential theft via hVNC, not a Brave vulnerability) - Mozilla — Firefox
Vulnerable versions: all versions (session/credential theft via hVNC, not a Firefox vulnerability) - Telegram — Telegram Desktop
Vulnerable versions: all versions (session/credential theft via hVNC, not a Telegram vulnerability)
Remediation for MedusaHVNC: Malware-as-a-Service RAT Uses Hidden Desktop
Immediate actions
- Block outbound network traffic to 51.89.204.28 (TCP/4444) at the perimeter/firewall/proxy.
- Alert on and investigate any child process spawned under charmap.exe — it has no legitimate children.
- Alert on AutoIt interpreter execution from user-writable temp directories (e.g., %TEMP%\Nx2981Okkr2-style random-named folders).
- Review Startup folder entries across endpoints for unrecognized items added outside change control.
- Force re-authentication and rotate credentials/session cookies for accounts on any host with confirmed compromise indicators.
Workarounds
- Network egress filtering to the known hardcoded C2 IP:port disrupts operator control since stolen session data and remote-desktop commands must traverse that fixed channel.
Longer-term hardening
- Deploy EDR/behavioral detection tuned to flag hidden desktop creation (multiple explorer.exe instances, browser processes with no visible window) and AMSI/ETW tamper events.
- Enforce application allowlisting or script-block logging for Windows Script Host (wscript.exe/cscript.exe) and unsigned AutoIt binaries.
- Deploy step-up/behavioral fraud analytics that do not rely solely on device/location trust signals, since hVNC session-riding is specifically designed to defeat them.
- Monitor and restrict outbound connections to uncommon high TCP ports from endpoint segments.
- Educate SOC/fraud teams on hVNC-class RATs and their use in bypassing device-fingerprint-based fraud controls.
Timeline of MedusaHVNC: Malware-as-a-Service RAT Uses Hidden Desktop
- Pandora hVNC, an earlier hidden-desktop RAT in the same product category as MedusaHVNC, begins circulating on cybercrime forums (per Cybereason's hVNC threat-landscape research), establishing the browser session-riding lineage — alongside DarkVNC, Venom RAT, XWorm, and Xeno RAT — that MedusaHVNC's MaaS offering continues.
- BlackFog originally publishes its technical analysis of MedusaHVNC's five-stage infection chain (JScript launcher, AutoIt-decrypted dropper, charmap.exe process hollowing, XOR/ChaCha20-layered final payload) and its hardcoded C2 (51.89.204.28:4444).
- Threadlinqs Intelligence Platform opens tracking (TL-2026-1723) for MedusaHVNC to drive detection-engineering coverage and IOC correlation against the active-MaaS distribution model.
- Researchers publish defensive guidance recommending network egress blocking to the disclosed C2 IP and endpoint monitoring for hVNC-specific behavioral indicators, since the malware evades signature-based detection.
- Hardcoded C2 IP:port (51.89.204.28:4444) and host-based indicators (charmap.exe child processes, AutoIt interpreter execution, Startup-folder anomalies, unusual high-port outbound connections) are publicly disclosed.
- Cybereason publishes 'Behind Closed Doors: The Rise of Hidden Malicious Remote Access,' situating MedusaHVNC-style hidden-desktop attacks within a broader hVNC/hRDP RAT lineage (Pandora hVNC, Venom RAT, XWorm, Xeno RAT, hVNC-capable Cobalt Strike tradecraft) and publishing behavioral detection guidance (multiple explorer.exe instances, browser/cmd.exe/powershell.exe processes with extra Desktop handles invisible on-screen).
- Cybersecurity News and SecurityWeek (via IT Security News syndication) republish and expand on the BlackFog findings, highlighting the AMSI/ETW bypass ('Mem Exec') and 'Browser Recovery' modules.
- SecurityAffairs publishes the first mainstream report on MedusaHVNC, describing it as a Malware-as-a-Service RAT using hidden-desktop (hVNC) browser session hijacking, citing BlackFog's research and quoting BlackFog researchers on session/cookie riding.
- BlackFog's analysis is last updated, confirming granular infection-chain artifacts: the dropped AutoIt interpreter (eepcxlhgdz.exe), encrypted payload file (zorsxklxfehdoals), Startup-folder batch script (AFLlvOscPj.bat), and exact obfuscation-layer sizes (1,009,152 bytes processed by the repeating XOR pass; 998,912 bytes of ChaCha20 ciphertext).
Sources cited for MedusaHVNC: Malware-as-a-Service RAT Uses Hidden Desktop
- MedusaHVNC trojan creates hidden desktops to hijack browsers and steal data
- MedusaHVNC RAT: Technical Analysis
- Hackers Can Use MedusaHVNC to Control Your PC on a Desktop You Cannot See
- MedusaHVNC Malware Uses Hidden Windows Desktops to Evade Detection
- Behind Closed Doors: The Rise of Hidden Malicious Remote Access
Detection coverage for TL-2026-1723
As of 2026-07-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1723 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.