The Invisible Browser Trick
Imagine an attacker opening Chrome on your computer, logging into your bank, and transferring money — all while you stare at a perfectly normal screen. That’s the reality of MedusaHVNC, a remote access trojan (RAT) sold as malware-as-a-service (MaaS).
Security researchers at BlackFog recently dissected this threat. Their findings reveal a sophisticated use of a legitimate Windows feature: hidden desktops. These are separate virtual desktops that Windows supports natively, often used by specialized software. Malware rarely exploits them. MedusaHVNC does.
The result is a RAT that operates completely out of sight. The user sees nothing. The attacker sees everything.
What Is MedusaHVNC?
MedusaHVNC is a remote access trojan distributed through its own website and a Telegram channel. It’s a commercial product in the cybercrime underground, offered as a service to other criminals. The name comes from its core feature: hidden virtual network computing (HVNC).
This technique allows the operator to create a hidden desktop session on the victim’s machine. On that invisible desktop, they can launch legitimate applications — Chrome, Edge, or Firefox — and interact with them as if they were sitting at the keyboard.
The victim’s own desktop remains untouched. No windows pop up. No cursor moves. The attack happens in a parallel digital space.
The 5-Stage Infection Chain
Getting to that hidden desktop requires a carefully orchestrated sequence. BlackFog’s analysis uncovered a five-stage infection chain that’s both clever and concerning.
Stage 1: The JScript Launcher
It starts with wscript.exe, a legitimate Windows script host. The script waits for just over 7.5 seconds — a delay likely designed to evade sandbox analysis. Then it builds its embedded files under %TEMP%Nx2981Okkr2.
Stage 2: Persistence
Several files are written to disc, including an encrypted payload and a .bat file in the Startup folder. That ensures the malware survives a reboot.
Stage 3: Decryption via AutoIT
Windows AutoIT is used to decrypt the payload and launch charmap.exe — the Windows character map utility. This is a classic process hollowing technique. The benign utility becomes the host for malicious code.
Stage 4: Double Encryption
The loader inside charmap.exe contains two more layers of protection. BlackFog’s researchers describe the process in detail:
“The first applies a 16-byte repeating XOR operation to 1,009,152 bytes from the .data section. The second uses ChaCha20 to decrypt 998,912 bytes of ciphertext with a 32-byte key, a 12-byte nonce, and an initial counter value of 1.”
This dual-layer approach makes analysis significantly harder.
Stage 5: The Final Payload
The final payload is an unsigned PE32+ x86-64 console executable. It contains a .pay section and the family string “MedusaHVNC.” It phones home to a hardcoded C2 address: 51.89.204.28:4444.
Living Off the Land
What makes MedusaHVNC particularly dangerous is its reliance on legitimate Windows functions. The malware uses BitBlt, EnumWindows, and PrintWindow for screen and window capture. SendInput and SetWindowsHookExW handle synthetic input and interaction.
Clipboard functions are also in play. OpenClipboard, GetClipboardData, and SetClipboardData provide another channel to move information in or out of the hidden session.
This is living-off-the-land at its finest. The attacker uses Windows’ own tools against the victim, making detection by traditional antivirus far more difficult.
Why Hidden Desktops Are a Problem
The hidden desktop approach has a significant advantage for attackers: it’s nearly invisible. The C2 is hardcoded, but it’s relatively safe from observation. The operator can browse the web, access internal resources, or exfiltrate data without raising a single flag.
This is a stealthy, persistent RAT. And it’s available to anyone willing to pay.
How to Defend Against MedusaHVNC
There’s no magic bullet. But BlackFog points to one critical mitigation: monitoring data exfiltration.
The logic is simple. Even if the RAT operates on a hidden desktop, the stolen data must eventually leave the network. Detecting unexplained data leaving your perimeter is always a red flag.
Here are practical steps to consider:
- Monitor outbound traffic: Look for unusual data transfers, especially to unfamiliar IPs.
- Hunt for hidden desktops: Use EDR tools to detect unusual desktop creation or charmap.exe anomalies.
- Restrict script execution: Limit wscript.exe and AutoIT usage where possible.
- Watch the Startup folder: Unexpected .bat files there are a clear indicator.
For more on related threats, check out our coverage of HVNC malware used by Russian cybercriminals and the Lobshot hVNC malware that surfaced recently. Also see how TrickBot targets Outlook and browser data.
The hidden desktop is a clever trick. But it’s not unbeatable. With the right visibility into network traffic, defenders can still catch the data as it tries to escape.
