MedusaHVNC uses hidden Windows virtual desktops to run browsers

Security firm BlackFog analyzed a remote access trojan named MedusaHVNC that launches legitimate browsers inside hidden Windows virtual desktops and communicates with a hardcoded command-and-control server at 51.89.204.28:4444. The tool is offered as malware-as-a-service and is promoted via a dedicated website and a Telegram channel.

BlackFog’s analysis shows the malware includes a hidden virtual network computing (HVNC) module that creates a separate desktop session on a compromised Windows machine. The attacker can choose Chrome, Edge or Firefox to run within that hidden session. Because the browser runs on a concealed desktop, its activity does not appear on the victim’s primary desktop.

The infection chain has five stages. It begins when the legitimate Windows process wscript.exe executes a JScript launcher that pauses for about 7.5 seconds before creating files under %TEMP%\Nx2981Okkr2\. Files written to disk include an encrypted payload and a batch file placed in the Startup folder to maintain persistence. The initial loader uses AutoIT to decrypt the payload and launches charmap.exe, the Windows character map utility, to host the next stage. The loader embedded in charmap.exe adds two encryption layers before installing the final payload.

BlackFog’s report details the encryption steps: a 16-byte repeating XOR operation applied to 1,009,152 bytes from the .data section, followed by a ChaCha20 decryption of 998,912 bytes using a 32-byte key, a 12-byte nonce and an initial counter value of 1. The final component is an unsigned PE32+ x86-64 console executable that contains a .pay section and the family string MedusaHVNC and that contacts the hardcoded C2 on port 4444.

The HVNC module uses standard Windows APIs to capture screens and interact with windows and input inside the hidden desktop. Functions observed include BitBlt, EnumWindows and PrintWindow for screen and window capture, SendInput and SetWindowsHookExW for synthetic input, and clipboard functions such as OpenClipboard, GetClipboardData and SetClipboardData to move information into or out of the hidden session.

BlackFog’s report notes the tool is designed for stealth and persistence and that the hardcoded C2 can make network detection harder if unexpected outbound connections are not monitored. The analysis recommends monitoring for anomalous startup entries, unexpected child processes of trusted utilities and unexplained outbound data flows as indicators that an HVNC tool may be active on a network.