MalwarePublished 28 Jul 2026

New Threat · Medusa HVNC

Source Reddit Cybersecurity

Discussion

MedusaHVNC is a newly identified remote access trojan (RAT) offered as malware-as-a-service that uses a hidden virtual desktop to steal live Windows sessions. It operates by opening a browser on a hidden desktop on the victim's machine, allowing attackers to access active logged-in sessions with the victim's browser profile, including cookies and session states. The infection chain involves multiple stages, including obfuscated JScript, AutoIt decryption, and payload injection into a trusted Windows process. The malware communicates with a hard-coded command-and-control server to enable remote control and data exfiltration.

r/cybersecurity (opens in a new tab)u/Dave_BlackFog0 points0 comments

I have to take my hat off to their creativity but deplore their lack of morals and ethics. Our threat research turned up something quite interesting. Follow the link below for the details...spoiler alert, they used a hidden desktop and RAT.

https://www.blackfog.com/medusahvnc-a-hidden-desktop/

Links cited in the discussion

https://www.blackfog.com/medusahvnc-a-hidden-desktop/

Impact

MedusaHVNC allows attackers to stealthily access and control live user sessions on infected Windows machines, including access to authenticated browser sessions and credentials. This capability enables credential theft, session hijacking, and potentially further lateral movement or data exfiltration. The malware's use of a hidden desktop and injection into trusted system processes complicates detection and response. The hard-coded C2 channel facilitates persistent remote control. However, there is no indication of widespread exploitation or known active attacks at this time.

Defensive guidance

Blocking outbound connections to the known C2 server IP address 51.89.204.28 on port 4444 is an effective mitigation step. Network monitoring and blocking of unexpected outbound traffic can prevent the malware from communicating with its operator. Endpoint detection should focus on unusual use of trusted processes like charmap.exe and the presence of hidden desktop sessions. Use of anti-data exfiltration technologies that monitor and block unauthorized outbound connections can also disrupt the attack.

Summary

MedusaHVNC is a 64-bit native Windows RAT that implements a hidden virtual network computing (HVNC) module to create a hidden desktop session on the victim's machine. This session runs browsers like Chrome, Edge, and Firefox with the victim's active profiles, enabling attackers to hijack live sessions invisibly. The infection chain begins with obfuscated JScript executed by wscript.exe, which stages components including an AutoIt interpreter and encrypted payloads. The payload is decrypted and injected into the Windows Character Map process (charmap.exe) to evade detection. The malware uses native Windows APIs for screen capture, synthetic input, window management, and clipboard manipulation to control the hidden desktop. It communicates over a custom TCP protocol to a hard-coded C2 server at 51.89.204.28:4444. The malware is marketed with features like in-memory execution with AMSI and ETW bypasses and browser data recovery capabilities.

References

Community reviews

Loading reviews…

Discussion

Links cited in the discussion

AI analysisMachine-generated, updated 13 Sep 2026, 18:49 UTC

Technical details

References

Community reviews