MedusaHVNC Malware Offers Hidden Remote Control via Virtual Desktops
A new malware-as-a-service, MedusaHVNC, allows attackers to silently control a victim's PC through a hidden virtual desktop, hijacking browser sessions and credentials.
A sophisticated new malware-as-a-service, dubbed MedusaHVNC, is enabling cybercriminals to gain covert remote access to victim computers. This malicious tool operates by creating a hidden virtual desktop on the compromised machine, allowing attackers to hijack active browser sessions, steal cookies, and access saved login credentials without raising any suspicion on the user's visible desktop. This evolution of hidden VNC (HVNC) techniques, previously seen in banking fraud, is now packaged for widespread criminal use.
Researchers at BlackFog have detailed how MedusaHVNC functions. It establishes a separate Windows desktop environment, complete with its own explorer.exe process. This separation ensures that the victim's primary desktop remains unaffected and shows no signs of intrusion. Crucially, by leveraging the victim's actual browser profile, session cookies, and existing logins, any malicious activity conducted through this hidden session appears legitimate, effectively bypassing many fraud detection systems that rely on location and device-based heuristics.
The malware is advertised with features designed for stealth and effectiveness. These include a "Mem Exec" capability for in-memory execution of payloads, bypassing security measures like AMSI (Antimalware Scan Interface) and ETW (Event Tracing for Windows). Additionally, its "Browser Recovery" function is capable of extracting saved passwords, cookies, and browsing history from popular browsers such as Chrome, Edge, Brave, and Firefox, as well as the Telegram messaging application.
The infection chain reportedly involves five distinct stages. It begins with a Windows Script Host executing an obfuscated JScript launcher. This launcher then reconstructs hidden malware components in a temporary directory and establishes a persistence mechanism, often by adding an entry to the Windows Startup folder, ensuring the malware survives reboots. An AutoIt interpreter subsequently decrypts the initial native payload using a simple XOR key.
In a classic living-off-the-land technique, the decrypted payload is injected into a legitimate Windows utility, such as charmap.exe (Character Map). This method helps the malware blend in with normal system processes, evading signature-based detection. The process continues with two additional layers of encryption, including XOR and ChaCha20, to unpack the final 64-bit payload.
This final payload establishes communication with a hard-coded command-and-control (C2) server using raw TCP sockets. Once active, it utilizes native Windows APIs to fully control the hidden desktop. This includes capabilities for screen and window capture, synthetic input generation for mouse and keyboard actions, and clipboard theft and injection, providing attackers with comprehensive control over the compromised system.
MedusaHVNC's operational design aligns with broader trends observed in other Medusa-branded threats. These campaigns frequently employ living-off-the-land binaries, in-memory execution, and legitimate remote access tools to evade endpoint detection and maintain persistent, low-visibility access. Security teams are advised to monitor for unusual child processes originating from legitimate system utilities like charmap.exe, suspicious AutoIt script executions, unexpected entries in the Startup folder, and outbound network connections to uncommon ports, as these behavioral indicators can signal HVNC activity even when the malware itself evades traditional detection methods.
This new analysis details the multi-stage infection chain employed by MedusaHVNC, beginning with a JScript launcher and progressing through multiple layers of encryption, including ChaCha20. It further elaborates on the specific Windows API functions used for screen capture and synthetic input, and highlights the malware's communication with its hardcoded command-and-control server at 51.89.204.28:4444.