# MedusaHVNC — Hidden Virtual Desktop RAT with AMSI/ETW Bypass and Multi-Browser Session Hijacking

> MedusaHVNC is a malware-as-a-service remote access Trojan that opens a hidden virtual desktop on Windows systems via a second explorer.exe process, then hijacks the victim's real browser profile and session cookies to extract saved passwords, cookies, and history from Chrome, Edge, Brave, Firefox, and Telegram, while using AMSI/ETW bypasses and in-memory execution to evade detection.

- **Published:** 2026-07-27T00:00:00Z
- **Last reviewed:** 2026-07-27T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1733
- **ID:** TL-2026-1733
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)

## Description

MedusaHVNC, documented by BlackFog researchers and reported by CybersecurityNews and SecurityWeek on 2026-07-27, is a hidden virtual network computing (HVNC) remote access Trojan sold as malware-as-a-service through a dedicated storefront website and a Telegram distribution channel. Its defining capability is spinning up a completely separate Windows desktop session with its own explorer.exe process; the operator opens a real browser (Chrome, Edge, or Firefox) on that hidden desktop using the victim's actual browser profile, so the session rides the victim's live authenticated cookies and appears as ordinary user traffic to the destination site, while the victim's visible screen shows nothing unusual.

Infection proceeds through a five-stage chain. Stage 1: the legitimate Windows Script Host (wscript.exe) executes an obfuscated JScript launcher that waits roughly 7,584 milliseconds before building its components in a randomly-named staging directory under %TEMP%\Nx2981Okkr2\. Stage 2: the launcher drops a renamed AutoIt interpreter (eepcxlhgdz.exe), an extensionless encrypted payload blob (zorsxklxfehdoals), and a batch file (AFLlvOscPj.bat) written to the Startup folder for persistence. Stage 3: the AutoIt interpreter decrypts the staged payload with a single-byte XOR key (0xAE), producing the first native 64-bit executable. Stage 4: that stage injects into a spawned instance of the legitimate Windows Character Map utility (charmap.exe), hosting the remainder of the payload under a trusted process identity to blend in with normal system activity. Stage 5: the injected code unpacks the final payload through two additional encryption layers — a 16-byte repeating-key XOR pass over 1,009,152 bytes of the .data section, followed by ChaCha20 decryption (32-byte key, 12-byte nonce, counter value 1) of 998,912 bytes — yielding an unsigned PE32+ x86-64 console executable containing a distinguishing .pay section and an embedded 'MedusaHVNC' family string.

The final payload communicates over a custom protocol built directly on native Winsock calls (WSAStartup, socket, connect, send, recv) — not an application-layer protocol like HTTP/HTTPS — to a hardcoded command-and-control server at 51.89.204.28 on TCP port 4444. Advertised operator features include 'Mem Exec' (in-memory execution of .NET and native payloads combined with an AMSI patch and an ETW bypass) and 'Browser Recovery' (extraction of saved passwords, cookies, and browsing history from Chrome, Edge, Brave, Firefox, and Telegram). Within the hidden desktop, the malware supports screen and window capture (BitBlt, EnumWindows, PrintWindow), synthetic input injection (SendInput, SetWindowsHookExW), and clipboard theft/manipulation (OpenClipboard, GetClipboardData, SetClipboardData). Neither BlackFog's writeup, SecurityWeek's coverage, nor CybersecurityNews's coverage disclosed file hashes, additional C2 infrastructure beyond the single hardcoded IP, a specific threat-actor name/alias, or a MaaS price list; a BeaconBeagle correlation check against 51.89.204.28 returned no existing beacon/config match as of 2026-07-27, indicating this C2 endpoint is not yet present in that index. No CVE applies — this is a crimeware delivery/evasion technique set, not a software vulnerability.

## MITRE ATT&CK

- T1059 Command and Scripting Interpreter
- T1547 Boot or Logon Autostart Execution
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1055 Process Injection
- T1036 Masquerading
- T1685 Disable or Modify Tools
- T1620 Reflective Code Loading
- T1010 Application Window Discovery
- T1113 Screen Capture
- T1115 Clipboard Data
- T1185 Browser Session Hijacking
- T1539 Steal Web Session Cookie
- T1555 Credentials from Password Stores
- T1005 Data from Local System
- T1095 Non-Application Layer Protocol
- T1571 Non-Standard Port
- T1219 Remote Access Tools

## Sources

- [MedusaHVNC — A Hidden Desktop](https://www.blackfog.com/medusahvnc-a-hidden-desktop/)
- [Hackers Can Use MedusaHVNC to Control Your PC on a Desktop You Cannot See](https://cybersecuritynews.com/medusahvnc-control-your-pc-silently/)
- [MedusaHVNC Malware Uses Hidden Windows Desktops to Evade Detection](https://www.securityweek.com/medusahvnc-malware-uses-hidden-windows-desktops-to-evade-detection/)
- [MedusaHVNC Malware Uses Hidden Windows Desktops to Evade Detection (mirror)](https://www.show.it/en/medusahvnc-malware-uses-hidden-windows-desktops-to-evade-detection/)
- [MedusaHVNC Malware Uses Hidden Windows Desktops to Evade Detection (mirror)](https://www.itsecuritynews.info/medusahvnc-malware-uses-hidden-windows-desktops-to-evade-detection/)
- [BeaconBeagle C2 infrastructure correlation check — 51.89.204.28 (no match)](https://beaconbeagle.com/api/v1/beacons/51.89.204.28)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1733