# MedusaHVNC: Malware-as-a-Service RAT Uses Hidden Desktop (hVNC) to Hijack Live Browser Sessions and Steal Credentials

> MedusaHVNC is a Malware-as-a-Service remote access trojan that opens a real browser on a completely hidden Windows desktop, letting operators ride the victim's already-authenticated Chrome, Edge, Brave, Firefox, and Telegram sessions while silently extracting passwords, cookies, and browsing history. It runs .NET/native payloads entirely in memory behind AMSI/ETW bypasses and communicates with a hardcoded C2 (51.89.204.28:4444) after a five-stage obfuscated infection chain.

- **Published:** 2026-07-27T00:00:00Z
- **Last reviewed:** 2026-07-27T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1723
- **ID:** TL-2026-1723
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 28 (full data via the Threadlinqs MCP server — Purple tier)

## Description

MedusaHVNC is a commercially distributed remote access trojan (RAT) sold as Malware-as-a-Service (MaaS) through a dedicated storefront and a Telegram marketing channel. Its defining capability is a hidden Virtual Network Computing (hVNC) module: rather than exploiting a vulnerability, the implant spins up an entirely separate Windows desktop session complete with its own explorer.exe process, invisible to the logged-in user, and launches a real instance of the victim's browser on it. Because that browser loads the victim's actual profile, saved sessions, and cookies, any activity the operator performs — logging into a bank portal, moving cryptocurrency, or authorizing a transaction — appears to originate from the victim's own trusted, already-authenticated device, defeating device- and location-based anti-fraud checks used by financial institutions.

Delivery and execution follow a documented five-stage chain: (1) Windows Script Host runs an obfuscated JScript launcher that sleeps ~7,584ms as a sandbox/time-based evasion measure before staging further components into a temporary working folder (observed as Temp\Nx2981Okkr2); (2) the launcher drops a legitimate AutoIt interpreter, configuration data, and an encrypted payload, and installs a Startup-folder entry for persistence; (3) the AutoIt interpreter decrypts the first native-stage payload using a single-byte XOR key (0xAE); (4) that stage injects into charmap.exe (the built-in Windows Character Map utility) via process hollowing, giving the malware a trusted-looking parent process; (5) the hollowed process unpacks the true final payload through two further obfuscation layers — a 16-byte repeating XOR pass over roughly 1MB of data followed by ChaCha20 decryption (32-byte key, 12-byte nonce, counter value 1). The recovered final artifact is an unsigned PE32+ x86-64 console executable containing a distinguishing '.pay' section and an embedded family identifier string.

Once running, MedusaHVNC advertises a 'Mem Exec' capability that executes .NET and native payloads entirely in memory while patching AMSI and disabling/bypassing ETW, minimizing on-disk and telemetry footprint. It abuses legitimate Windows APIs to operate the hidden desktop and steal data: BitBlt, EnumWindows, and PrintWindow for screen capture and window enumeration; SendInput and SetWindowsHookExW to drive synthetic mouse/keyboard input into the hidden browser session; and OpenClipboard/GetClipboardData/SetClipboardData for clipboard access (useful for both data theft and clipboard-swap fraud such as cryptocurrency address substitution). A 'Browser Recovery' module additionally extracts saved passwords, cookies, and browsing history directly from Chrome, Edge, Brave, Firefox, and the Telegram desktop client. All observed C2 traffic uses a custom protocol over raw TCP sockets to a single hardcoded IP:port (51.89.204.28:4444) rather than dynamic DNS resolution or an HTTP(S)-based channel, making network egress filtering to that IP an effective, if narrow, mitigation.

MedusaHVNC's architecture mirrors a broader lineage of hVNC/hRDP-capable commodity RATs marketed to cybercriminals (e.g., DarkVNC, Venom RAT, XWorm, Pandora hVNC, Xeno RAT) that have long been used in banking-fraud and account-takeover operations; MedusaHVNC packages the same hidden-desktop session-riding technique with modern in-memory execution and AMSI/ETW evasion for affiliate-model resale. Because it is a MaaS toolkit rather than a single campaign, it is expected to be deployed by multiple, financially motivated affiliates rather than one attributable actor.

## MITRE ATT&CK

- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1106 Native API
- T1547 Boot or Logon Autostart Execution
- T1055 Process Injection
- T1055 Process Injection
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1685 Disable or Modify Tools
- T1620 Reflective Code Loading
- T1218 System Binary Proxy Execution
- T1497 Virtualization/Sandbox Evasion
- T1564 Hide Artifacts
- T1555 Credentials from Password Stores
- T1539 Steal Web Session Cookie
- T1185 Browser Session Hijacking
- T1010 Application Window Discovery
- T1021 Remote Services
- T1113 Screen Capture
- T1115 Clipboard Data
- T1571 Non-Standard Port
- T1095 Non-Application Layer Protocol
- T1041 Exfiltration Over C2 Channel

## Sources

- [MedusaHVNC trojan creates hidden desktops to hijack browsers and steal data](https://securityaffairs.com/196111/malware/medusahvnc-trojan-creates-hidden-desktops-to-hijack-browsers-and-steal-data.html)
- [MedusaHVNC RAT: Technical Analysis](https://www.blackfog.com/medusahvnc/)
- [Hackers Can Use MedusaHVNC to Control Your PC on a Desktop You Cannot See](https://cybersecuritynews.com/medusahvnc-control-your-pc-silently/)
- [MedusaHVNC Malware Uses Hidden Windows Desktops to Evade Detection](https://www.itsecuritynews.info/medusahvnc-malware-uses-hidden-windows-desktops-to-evade-detection/)
- [Behind Closed Doors: The Rise of Hidden Malicious Remote Access](https://www.cybereason.com/blog/behind-closed-doors-the-rise-of-hidden-malicious-remote-access)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1723