MedusaHVNC Trojan Hijacks Browsers Using Hidden Desktops
New RAT abuses Windows' hidden desktop feature for stealthy data theft.
1MedusaHVNC's Unique Operation Method
MedusaHVNC is a new remote access trojan (RAT) that exploits Windows' little-known hidden desktop feature. Analyzed by BlackFog's research team, this malware opens browsers on a separate desktop invisible to victims to steal session data. Marketed as malware-as-a-service (MaaS), MedusaHVNC targets sessions in Chrome, Edge, Brave, Firefox, and Telegram. Since browsers run on the victim's device, attackers gain access to all cookies and active login sessions, making credential theft seamless while appearing to originate from the victim's usual machine.
2Professionally Designed Operator Panel
A video obtained by BlackFog reveals MedusaHVNC's operator panel can launch Google Chrome on Google's homepage with pre-authenticated sessions. The panel includes frame rate and image quality adjustments resembling video conferencing software. These sophisticated features indicate professional development rather than amateur coding. Operators can select which browser to run (Chrome, Edge, or Firefox) and configure sessions before launch, transforming account takeover into an almost point-and-click operation with alarming ease.
3Five-Stage Stealth Infection Process
MedusaHVNC's infection chain comprises five meticulously designed stages. Initially, an obfuscated JScript launcher executed by Windows Script Host pauses for exactly 7,584 milliseconds - a deliberate delay to evade sandbox detection systems that typically monitor samples briefly. It then reconstructs its components in a Temp directory folder named Nx2981Okkr2. The malware deploys an AutoIt interpreter, configuration file, extensionless encrypted payload, and a persistence mechanism via a batch script in the Startup folder to survive reboots.
4Malware Masquerading as Character Map
Using a single-byte XOR key (0xAE), AutoIt decrypts the payload to produce the first native 64-bit executable in the chain, which launches charmap.exe - Windows' built-in Character Map utility. The malicious loader injects itself into this trusted system binary, creating perfect camouflage. Security analysts scanning process lists would likely overlook this entry, as few system components appear more innocuous than the character map tool. This demonstrates attackers' creativity in weaponizing legitimate system binaries.
5Triple-Layered Encryption and Obfuscation
Within charmap.exe, the loader employs three successive obfuscation layers: a 16-byte repeating XOR pass across 1MB+ data, followed by ChaCha20 decryption using a 32-byte key and 12-byte nonce, before revealing the final payload. Each layer serves to slow reverse-engineering efforts. BlackFog reconstructed this entire unpacking process offline, recovering the final payload byte-for-byte - a testament to their thorough forensic analysis. The extracted 64-bit executable contains the internal string MedusaHVNC.
6Abuse of Native Windows APIs
Once the hidden session activates, MedusaHVNC exclusively utilizes legitimate Windows APIs: BitBlt, EnumWindows, and PrintWindow for screen/window capture; SendInput and SetWindowsHookExW for synthetic input; clipboard functions (OpenClipboard, GetClipboardData, SetClipboardData) for data exfiltration. Since these APIs are commonly used by remote support software, behavior-based security tools struggle to flag them as malicious. This highlights the challenge of detecting malware that operates entirely within system-sanctioned boundaries.
7Fixed Infrastructure: Pros and Cons
MedusaHVNC communicates with operators via a custom protocol built on Windows' native networking functions. The command server address (51.89.204.28:4444) is hardcoded rather than resolved dynamically. While this static infrastructure simplifies attacker operations, it also presents a persistent target for defenders - once identified, the IP can be permanently blocked. BlackFog's report emphasizes how such fixed command-and-control servers create operational vulnerabilities for malware operators.
8Security Implications and Recommendations
The MedusaHVNC case demonstrates attackers' innovative abuse of legitimate system features. Exploitation of obscure Windows capabilities like hidden desktops exposes limitations in signature-based antivirus solutions. Organizations should implement advanced protections: behavioral analysis for detecting anomalous process relationships, strict application whitelisting to prevent abuse of tools like AutoIt, and least-privilege user accounts to limit damage. Continuous monitoring for child processes spawned from unlikely parents (e.g., charmap.exe from AutoIt) could help identify similar threats.