MedusaHVNC: a malware-as-a-service RAT that drives the victim's own logged-in browser on an invisible second Windows desktop
The interesting property of MedusaHVNC is not that it steals credentials — it does, and advertises a "Browser Recovery" feature for passwords, cookies and history across Chrome, Edge, Brave, Firefox and Telegram — but that it makes stealing them partly unnecessary. Its hidden-VNC module opens a real browser on a second, invisible Windows desktop, and because "[t]he browser still runs on the victim's device, so it can load an existing profile, including cookies and session state", the operator inherits whatever the user is already logged into (BlackFog, 2026-07-27). The resulting traffic leaves the victim's machine, from the victim's network, with the victim's browser profile and device characteristics — which is the entire point, since the fraud and risk-engine controls that would normally challenge a session key on exactly those signals. SecurityWeek's account of the same research notes that hidden desktops are a legitimate Windows capability used by specialised software and only occasionally by malware (SecurityWeek, 2026-07-27).
The delivery chain is five stages and leans on trusted components throughout. Windows Script Host executes an obfuscated JScript launcher, which sleeps for just over seven and a half seconds before reconstructing its embedded files into a randomly named subfolder of %TEMP% — an AutoIt interpreter, a configuration file and an extensionless encrypted payload — and dropping a batch file into the Startup folder for persistence. The AutoIt component runs without a visible window, decrypts the payload with a single-byte XOR key to produce a native 64-bit loader, and then launches C:\Windows\System32\charmap.exe, the Character Map utility, into which the loader is injected; BlackFog notes this stage is corroborated by a public sandbox process tree showing charmap.exe as a child of the AutoIt process. Inside that host process two further layers come off — a 16-byte repeating XOR across roughly a megabyte of the .data section, then ChaCha20 with a 32-byte key and 12-byte nonce — yielding an unsigned PE32+ console executable carrying a .pay section and the family string. Alongside the hidden desktop, the seller's own panel advertises a "Mem Exec" feature described as running .NET and native payloads in memory with an AMSI patch and ETW bypass — security-tooling tampering that BlackFog reports from the marketplace listing rather than from the analysed sample, so it should be treated as claimed capability rather than confirmed behaviour. The payload speaks a custom protocol over raw TCP via native Winsock calls to a hardcoded endpoint, and its imported API surface is what BlackFog reads as the HVNC workflow: BitBlt, EnumWindows and PrintWindow for screen and window capture, SendInput and SetWindowsHookExW for synthetic input, and the clipboard functions for moving data into and out of the session (BlackFog, 2026-07-27).
Triage: charmap.exe is the sharpest discriminator in the chain. The Character Map is an interactive accessory a user opens from the Start menu; an instance spawned by a scripting or automation interpreter, running with no window, holding a network socket, or hosting injected code is not a benign variant of that behaviour. Around it, look for the sequence rather than any single event — wscript.exe executing script content that writes an AutoIt interpreter into a %TEMP% subfolder, a Startup-folder write from that same process tree, and an AutoIt binary running from a user-writable path where the organisation does not deploy AutoIt. Legitimate AutoIt use exists in many estates, which is why the parent chain and the write location matter more than the interpreter's presence. The hidden desktop itself is the weakest thing to hunt for, since the capability is a supported Windows feature with genuine software using it.
The browser still runs on the victim’s device, so it can load an existing profile, including cookies and session state.
The AutoIt stage then starts C:\\Windows\\System32\\charmap.exe, the standard Windows Character Map utility. The public sandbox process tree shows charmap.exe as a child of the AutoIt process, and the loader is injected into it, using the trusted system binary as a host for the payload.
Hidden desktops are a legitimate Windows capability, often used by specialized software, and occasionally used by malware.
ATT&CK mapping
10 techniques mapped from the cited reporting · MITRE ATT&CK v19.1
Execution TA0002
T1059.007Command and Scripting Interpreter: JavaScript
Adversaries may abuse various implementations of JavaScript for execution. JavaScript (JS) is a platform-independent scripting language (compiled just-in-time at runtime) commonly associated with scripts in webpages, though JS can be executed in runtime environments outside the browser.
Persistence TA0003
T1547.001Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Privilege Escalation TA0004
T1055Process Injection
Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
T1547.001Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Stealth TA0005
T1055Process Injection
Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
T1140Deobfuscate/Decode Files or Information
Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
T1564.003Hide Artifacts: Hidden Window
Adversaries may use hidden windows to conceal malicious activity from the plain sight of users. In some cases, windows that would typically be displayed when an application carries out an operation can be hidden. This may be utilized by system administrators to avoid disrupting user work environments when carrying out administrative tasks.
Defense Impairment TA0112
T1685Disable or Modify Tools
Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities. This may include stopping specific services, killing processes, modifying or deleting tool configuration files and Registry keys, or preventing tools from updating. This may also include impairing defenses more broadly by disrupting preventative, detection, and response mechanisms across host, network, and cloud environments.
Credential Access TA0006
T1539Steal Web Session Cookie
An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials. Web applications and services often use session cookies as an authentication token after a user has authenticated to a website.
T1555.003Credentials from Password Stores: Credentials from Web Browsers
Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an encrypted format within a credential store; however, methods exist to extract plaintext credentials from web browsers.
Collection TA0009
T1115Clipboard Data
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
T1185Browser Session Hijacking
Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.