MedusaHVNC: Remote Control of Logged-in Browsers on Hidden Windows Desktops

MedusaHVNC: Remote Control of Logged-in Browsers on Hidden Windows Desktops 1. Basic Information Article Title : MedusaHVNC Malware Uses Hidden Windows Desktops to Evade Detection Publisher : SecurityWeek Publication Date : 2026-07-27 Original Article : https://www.securityweek.com/medusahvnc-malware-uses-hidden-windows-desktops-to-evade-detection/ Primary Source : https://www.blackfog.com/medusahvnc-a-hidden-desktop/ Related Entities : MedusaHVNC, MaaS, HVNC, JScript, AutoIt, charmap.exe , ChaCha20, Chrome/Edge/Firefox Severity : High IOCs : 51.89.204.28:4444 , %TEMP%\Nx2981Okkr2\ , AFLlvOscPj.bat , zorsxklxfehdoals 2. Executive Summary This is a RAT that uses JScript, AutoIt, charmap.exe injection, and multi-layer decryption to open logged-in browsers on a hidden Windows desktop invisible to the user. It controls existing cookies and sessions using the victim device's original IP address. 3. Attack Flow wscript.exe runs an obfuscated JScript file and waits for 7,584 milliseconds. It extracts the AutoIt execution system, configuration, and encrypted payload to %TEMP%\Nx2981Okkr2\ . It places AFLlvOscPj.bat in the Startup folder for persistence. AutoIt decrypts the payload using single-byte XOR 0xAE . It starts the legitimate C:\Windows\System32\charmap.exe and injects the loader into it. It decrypts the final x64 PE file using 16-byte repeating XOR and ChaCha20. It makes a custom TCP connection to 51.89.204.28:4444 . It creates another hidden desktop and launches Chrome, Edge, or Firefox. It captures screens using BitBlt and PrintWindow , sends inputs using SendInput , and moves data using the Clipboard API. It uses cookies and sessions from existing browser profiles to control user accounts. 4. Attacker Position and Execution Location The attacker uses a MaaS operation panel and C2 server. The loader and HVNC run on the Windows device, and the browser runs on a separate desktop invisible to the user, but on the same device, IP, and profile. The initial delivery ve