CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

MedusaHVNC

tool · tool:medusahvnc single-source

Windows remote-access trojan sold as malware-as-a-service through a dedicated storefront and Telegram channel, whose hidden-VNC module opens Chrome, Edge or Firefox on a separate invisible Windows desktop using the victim's existing browser profile, giving the operator live authenticated sessions that originate from the victim's own device. Delivered through a five-stage chain: an obfuscated JScript launcher, an AutoIt interpreter that XOR-decrypts a loader and injects it into charmap.exe, and repeating-XOR plus ChaCha20 layers before the final payload, which speaks a custom protocol over raw TCP. Analysed by BlackFog (2026-07-27); no relationship to the Medusa or MedusaLocker ransomware families is claimed by any cited source.

Coverage
1
first 2026-07-28 → last 2026-07-28
Latest activity
2026-07-28
MedusaHVNC rides real logged-in browser sessions on a hidden Windows desktop, defeating device-based fraud…
Peak priority
notable
1 notable
Targets
finance
sectors: finance, technology
Sources cited
2
2 hosts

Defender insights

What each entry about MedusaHVNC tells a defender to do, newest first.

2026-07-28NOTABLEMedusaHVNC rides real logged-in browser sessions on a hidden Windows desktop, defeating device-based fraud checks

Triage

Story timeline

  1. 2026-07-28MedusaHVNC: a malware-as-a-service RAT that drives the victim's own logged-in browser on an invisible second Windows desktop
    active-threatsMedusaHVNC rides real logged-in browser sessions on a hidden Windows desktop, defeating device-based fraud checks

Hunting pivots

Affected products
Google ChromeMicrosoft EdgeMicrosoft WindowsMozilla Firefox
Tags
identityinfostealer
ATT&CK techniques (10 across 7 tactics)

10 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • ExecutionCommand and Scripting Interpreter: JavaScript
  • PersistenceBoot or Logon Autostart Execution: Registry Run Keys / Startup Folder
  • Privilege EscalationProcess Injection · Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
  • StealthProcess Injection · Deobfuscate/Decode Files or Information · Hide Artifacts: Hidden Window
  • Defense ImpairmentDisable or Modify Tools
  • Credential AccessSteal Web Session Cookie · Credentials from Password Stores: Credentials from Web Browsers
  • CollectionClipboard Data · Browser Session Hijacking

Execution TA0002

T1059.007Command and Scripting Interpreter: JavaScript×1

Adversaries may abuse various implementations of JavaScript for execution. JavaScript (JS) is a platform-independent scripting language (compiled just-in-time at runtime) commonly associated with scripts in webpages, though JS can be executed in runtime environments outside the browser.

Evidence: 2026-07-28/medusahvnc-hidden-desktop-browser-session-hijacking · ATT&CK page ↗

Persistence TA0003

T1547.001Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder×1

Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.

Evidence: 2026-07-28/medusahvnc-hidden-desktop-browser-session-hijacking · ATT&CK page ↗

Privilege Escalation TA0004

T1055Process Injection×1

Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.

Evidence: 2026-07-28/medusahvnc-hidden-desktop-browser-session-hijacking · ATT&CK page ↗

T1547.001Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder×1

Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.

Evidence: 2026-07-28/medusahvnc-hidden-desktop-browser-session-hijacking · ATT&CK page ↗

Stealth TA0005

T1055Process Injection×1

Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.

Evidence: 2026-07-28/medusahvnc-hidden-desktop-browser-session-hijacking · ATT&CK page ↗

T1140Deobfuscate/Decode Files or Information×1

Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.

Evidence: 2026-07-28/medusahvnc-hidden-desktop-browser-session-hijacking · ATT&CK page ↗

T1564.003Hide Artifacts: Hidden Window×1

Adversaries may use hidden windows to conceal malicious activity from the plain sight of users. In some cases, windows that would typically be displayed when an application carries out an operation can be hidden. This may be utilized by system administrators to avoid disrupting user work environments when carrying out administrative tasks.

Evidence: 2026-07-28/medusahvnc-hidden-desktop-browser-session-hijacking · ATT&CK page ↗

Defense Impairment TA0112

T1685Disable or Modify Tools×1

Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities. This may include stopping specific services, killing processes, modifying or deleting tool configuration files and Registry keys, or preventing tools from updating. This may also include impairing defenses more broadly by disrupting preventative, detection, and response mechanisms across host, network, and cloud environments.

Evidence: 2026-07-28/medusahvnc-hidden-desktop-browser-session-hijacking · ATT&CK page ↗

Credential Access TA0006

T1539Steal Web Session Cookie×1

An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials. Web applications and services often use session cookies as an authentication token after a user has authenticated to a website.

Evidence: 2026-07-28/medusahvnc-hidden-desktop-browser-session-hijacking · ATT&CK page ↗

T1555.003Credentials from Password Stores: Credentials from Web Browsers×1

Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an encrypted format within a credential store; however, methods exist to extract plaintext credentials from web browsers.

Evidence: 2026-07-28/medusahvnc-hidden-desktop-browser-session-hijacking · ATT&CK page ↗

Collection TA0009

T1115Clipboard Data×1

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

Evidence: 2026-07-28/medusahvnc-hidden-desktop-browser-session-hijacking · ATT&CK page ↗

T1185Browser Session Hijacking×1

Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.

Evidence: 2026-07-28/medusahvnc-hidden-desktop-browser-session-hijacking · ATT&CK page ↗

Entries about MedusaHVNC (1)

2026-07-28 · view entry permalink →

NOTABLENATOB2

MedusaHVNC: a malware-as-a-service RAT that drives the victim's own logged-in browser on an invisible second Windows desktop

The interesting property of MedusaHVNC is not that it steals credentials (it does, and advertises a "Browser Recovery" feature for passwords, cookies and history across Chrome, Edge, Brave, Firefox and Telegram) but that it makes stealing them partly unnecessary. Its hidden-VNC module opens a real browser on a second, invisible Windows desktop, and because "[t]he browser still runs on the victim's device, so it can load an existing profile, including cookies and session state", the operator inherits whatever the user is already logged into (BlackFog, 2026-07-27). The resulting traffic leaves the victim's machine, from the victim's network, with the victim's browser profile and device characteristics, which is the entire point, since the fraud and risk-engine controls that would normally challenge a session key on exactly those signals. SecurityWeek's account of the same research notes that hidden desktops are a legitimate Windows capability used by specialised software and only occasionally by malware (SecurityWeek, 2026-07-27).

The delivery chain is five stages and leans on trusted components throughout. Windows Script Host executes an obfuscated JScript launcher, which sleeps for just over seven and a half seconds before reconstructing its embedded files into a randomly named subfolder of %TEMP% (an AutoIt interpreter, a configuration file and an extensionless encrypted payload) and dropping a batch file into the Startup folder for persistence. The AutoIt component runs without a visible window, decrypts the payload with a single-byte XOR key to produce a native 64-bit loader, and then launches C:\Windows\System32\charmap.exe, the Character Map utility, into which the loader is injected; BlackFog notes this stage is corroborated by a public sandbox process tree showing charmap.exe as a child of the AutoIt process. Inside that host process two further layers come off (a 16-byte repeating XOR across roughly a megabyte of the .data section, then ChaCha20 with a 32-byte key and 12-byte nonce) yielding an unsigned PE32+ console executable carrying a .pay section and the family string. Alongside the hidden desktop, the seller's own panel advertises a "Mem Exec" feature described as running .NET and native payloads in memory with an AMSI patch and ETW bypass, security-tooling tampering that BlackFog reports from the marketplace listing rather than from the analysed sample, so it should be treated as claimed capability rather than confirmed behaviour. The payload speaks a custom protocol over raw TCP via native Winsock calls to a hardcoded endpoint, and its imported API surface is what BlackFog reads as the HVNC workflow: BitBlt, EnumWindows and PrintWindow for screen and window capture, SendInput and SetWindowsHookExW for synthetic input, and the clipboard functions for moving data into and out of the session (BlackFog, 2026-07-27).

Triage: charmap.exe is the sharpest discriminator in the chain. The Character Map is an interactive accessory a user opens from the Start menu; an instance spawned by a scripting or automation interpreter, running with no window, holding a network socket, or hosting injected code is not a benign variant of that behaviour. Around it, look for the sequence rather than any single event, wscript.exe executing script content that writes an AutoIt interpreter into a %TEMP% subfolder, a Startup-folder write from that same process tree, and an AutoIt binary running from a user-writable path where the organisation does not deploy AutoIt. Legitimate AutoIt use exists in many estates, which is why the parent chain and the write location matter more than the interpreter's presence. The hidden desktop itself is the weakest thing to hunt for, since the capability is a supported Windows feature with genuine software using it.

The browser still runs on the victim’s device, so it can load an existing profile, including cookies and session state.

The AutoIt stage then starts C:\\Windows\\System32\\charmap.exe, the standard Windows Character Map utility. The public sandbox process tree shows charmap.exe as a child of the AutoIt process, and the loader is injected into it, using the trusted system binary as a host for the payload.

BlackFog 2026-07-27

Hidden desktops are a legitimate Windows capability, often used by specialized software, and occasionally used by malware.

SecurityWeek 2026-07-27
threat28 Jul 04:55Zsingle-sourceOpen finding →
Sources: BlackFog · SecurityWeek

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Threats1

Source distribution

  • blackfog.com1 (50%)
  • securityweek.com1 (50%)
All cited sources (2)