2026-07-28 · view entry permalink →
MedusaHVNC: a malware-as-a-service RAT that drives the victim's own logged-in browser on an invisible second Windows desktop
The interesting property of MedusaHVNC is not that it steals credentials — it does, and advertises a "Browser Recovery" feature for passwords, cookies and history across Chrome, Edge, Brave, Firefox and Telegram — but that it makes stealing them partly unnecessary. Its hidden-VNC module opens a real browser on a second, invisible Windows desktop, and because "[t]he browser still runs on the victim's device, so it can load an existing profile, including cookies and session state", the operator inherits whatever the user is already logged into (BlackFog, 2026-07-27). The resulting traffic leaves the victim's machine, from the victim's network, with the victim's browser profile and device characteristics — which is the entire point, since the fraud and risk-engine controls that would normally challenge a session key on exactly those signals. SecurityWeek's account of the same research notes that hidden desktops are a legitimate Windows capability used by specialised software and only occasionally by malware (SecurityWeek, 2026-07-27).
The delivery chain is five stages and leans on trusted components throughout. Windows Script Host executes an obfuscated JScript launcher, which sleeps for just over seven and a half seconds before reconstructing its embedded files into a randomly named subfolder of %TEMP% — an AutoIt interpreter, a configuration file and an extensionless encrypted payload — and dropping a batch file into the Startup folder for persistence. The AutoIt component runs without a visible window, decrypts the payload with a single-byte XOR key to produce a native 64-bit loader, and then launches C:\Windows\System32\charmap.exe, the Character Map utility, into which the loader is injected; BlackFog notes this stage is corroborated by a public sandbox process tree showing charmap.exe as a child of the AutoIt process. Inside that host process two further layers come off — a 16-byte repeating XOR across roughly a megabyte of the .data section, then ChaCha20 with a 32-byte key and 12-byte nonce — yielding an unsigned PE32+ console executable carrying a .pay section and the family string. Alongside the hidden desktop, the seller's own panel advertises a "Mem Exec" feature described as running .NET and native payloads in memory with an AMSI patch and ETW bypass — security-tooling tampering that BlackFog reports from the marketplace listing rather than from the analysed sample, so it should be treated as claimed capability rather than confirmed behaviour. The payload speaks a custom protocol over raw TCP via native Winsock calls to a hardcoded endpoint, and its imported API surface is what BlackFog reads as the HVNC workflow: BitBlt, EnumWindows and PrintWindow for screen and window capture, SendInput and SetWindowsHookExW for synthetic input, and the clipboard functions for moving data into and out of the session (BlackFog, 2026-07-27).
Triage: charmap.exe is the sharpest discriminator in the chain. The Character Map is an interactive accessory a user opens from the Start menu; an instance spawned by a scripting or automation interpreter, running with no window, holding a network socket, or hosting injected code is not a benign variant of that behaviour. Around it, look for the sequence rather than any single event — wscript.exe executing script content that writes an AutoIt interpreter into a %TEMP% subfolder, a Startup-folder write from that same process tree, and an AutoIt binary running from a user-writable path where the organisation does not deploy AutoIt. Legitimate AutoIt use exists in many estates, which is why the parent chain and the write location matter more than the interpreter's presence. The hidden desktop itself is the weakest thing to hunt for, since the capability is a supported Windows feature with genuine software using it.
The browser still runs on the victim’s device, so it can load an existing profile, including cookies and session state.
The AutoIt stage then starts C:\\Windows\\System32\\charmap.exe, the standard Windows Character Map utility. The public sandbox process tree shows charmap.exe as a child of the AutoIt process, and the loader is injected into it, using the trusted system binary as a host for the payload.
Hidden desktops are a legitimate Windows capability, often used by specialized software, and occasionally used by malware.