Shadow hVNC Creates Hidden Desktops for Stealthy Remote Access and Data Theft
A new Go-based remote access tool, Shadow hVNC, allows attackers to control a hidden Windows desktop, steal credentials, and operate undetected.
A sophisticated new remote access tool dubbed Shadow hVNC is enabling attackers to gain covert control over victim systems by creating a hidden Windows desktop environment. Unlike traditional remote access tools that take over the visible user interface, Shadow hVNC establishes a separate, invisible workspace where threat actors can operate without the victim's knowledge. This allows for the stealthy exfiltration of sensitive data, including browser cookies, saved passwords, financial information, and active session tokens, thereby facilitating account hijacking.
Researchers at Malbear Labs identified the latest iteration of Shadow hVNC as a 16.4 MB Go-based payload. The malware features a hardcoded command server and relatively readable code paths, making its analysis more straightforward for security professionals. The tool was advertised on criminal forums as early as March 2026 under the name RemoteX. Its associated loader has been observed in malspam campaigns that use deceptive copyright notices to trick users, particularly those managing business pages, into executing the payload.
The core functionality of Shadow hVNC revolves around its ability to create a hidden Windows desktop, referred to as 'RemoteXHidden,' and attach a worker process to it. Within this hidden environment, operators can launch applications such as browsers, command shells, or PowerShell instances. The malware then streams screen frames from this hidden desktop to the attacker and accepts remote mouse clicks and keystrokes. This clandestine operation allows for extensive reconnaissance and data theft without raising immediate suspicion.
Shadow hVNC also boasts a 'Backstage' mode, which allows attackers to open a browser instance that utilizes the victim's real profile. This enables the attacker to leverage live cookies and active login sessions, bypassing the need for credentials and potentially circumventing multi-factor authentication. The ability to hijack active sessions directly from stolen cookies presents a significant threat to banking, cloud services, and corporate applications that rely on authenticated user sessions.
In scenarios where the creation of a hidden desktop fails, Shadow hVNC can resort to more intrusive methods. It has the capability to freeze the victim's keyboard and mouse input, and even turn off the physical monitor, creating the illusion that the computer is idle while the attacker actively works within the compromised session. Furthermore, the malware has been observed to repeatedly terminate the victim's Chrome browser process to seize control of the legitimate browser profile, a tactic that can manifest as unexpected browser crashes alongside suspicious background activity.
The data-stealing capabilities of Shadow hVNC are extensive, encompassing cookies, passwords, browser profile data, cryptocurrency wallets, chat sessions, VPN configurations, and cloud credentials. The embedded 'lss.exe' utility is particularly concerning, as it can dump the memory of the Local Security Authority Subsystem Service (LSASS) when the malware has administrator privileges. This allows attackers to harvest credentials that can be used for lateral movement within a compromised network.
Persistence is a key feature of Shadow hVNC, with multiple techniques employed to ensure its continued presence on a victim's system. These include copying itself to local application data folders, registering disguised services (e.g., 'mouse driver service'), creating Run entries and scheduled tasks, and deploying a watchdog process named 'WmiPrvSE.exe' to relaunch the payload if terminated. The malware also attempts to add exclusions to security software when elevated, further complicating detection and removal efforts.
Defenders are advised to monitor for unusual hidden desktop activity, suspicious browser database copies ending in '.rxcopy,' and profile-staging folders under the 'RemoteX' path. Investigating unexpected scheduled tasks, new registry Run values, security exclusion changes, and processes that terminate browsers are also crucial. In response to a suspected infection, organizations should isolate affected devices, preserve logs, reset exposed sessions and credentials from a separate system, and thoroughly review administrator access privileges. Revoking active sessions is paramount, as stolen cookies can bypass password-based authentication and MFA.