A newly identified remote access Trojan, MedusaHVNC, enables cybercriminals to establish a concealed virtual desktop on a victim’s computer. This hidden environment allows attackers to access the user’s browser profiles, cookies, and active sessions without any visible signs of intrusion.
MedusaHVNC is marketed as malware-as-a-service through dedicated platforms, reflecting an evolution of hidden VNC (HVNC) techniques traditionally used in banking fraud. This packaging makes it accessible for criminals to purchase and deploy.
Security researchers have observed that the malware creates a separate Windows desktop with its own explorer.exe process. Consequently, the victim’s screen remains unchanged while the attacker operates in the background. By utilizing the infected machine’s real browser profile, session cookies, and saved logins, the malicious activity appears to originate from a trusted device, effectively bypassing many fraud detection mechanisms employed by financial institutions.
MedusaHVNC’s Capabilities and Infection Process
MedusaHVNC boasts features such as in-memory execution of .NET and native payloads, along with bypasses for AMSI and ETW. It also includes a ‘Browser Recovery’ function that extracts saved passwords, cookies, and browsing history from browsers like Chrome, Edge, Brave, Firefox, and applications like Telegram.
The malware’s operator panel allows attackers to select target applications, initiate hidden desktop sessions, and adjust settings like frame rate and image quality while monitoring the compromised browser in real-time. This functionality aligns with other Medusa-branded malware families that offer turnkey criminal tools through affiliate models.
The infection process unfolds in five stages:
- A JScript launcher executed by Windows Script Host reconstructs hidden components in a temporary folder and establishes persistence by adding an entry to the Startup folder.
- An AutoIt interpreter decrypts the initial payload using an XOR key and injects it into the legitimate Windows Character Map utility (charmap.exe), a technique that helps the malware blend with trusted system processes.
- Subsequent layers of encryption, including XOR and ChaCha20, unpack the final 64-bit payload.
- The payload communicates with a hard-coded command-and-control server over raw TCP sockets.
- Once active, the malware utilizes native Windows APIs to operate the hidden desktop, capturing screens and windows, simulating user input, and accessing clipboard data.
MedusaHVNC’s design mirrors broader trends among Medusa-branded threats, where operators favor living-off-the-land binaries, in-memory execution, and legitimate remote-access tools to evade detection while maintaining persistent, low-visibility access.
Security teams should monitor for unexpected child processes under charmap.exe, unusual AutoIt script executions, suspicious Startup folder entries, and outbound connections to uncommon high ports. These behavioral indicators can reveal HVNC activity even when the malware evades signature-based detection.
The emergence of MedusaHVNC underscores the increasing sophistication of malware-as-a-service offerings and the challenges they pose to cybersecurity defenses. Organizations must enhance their monitoring capabilities and adopt behavioral analysis techniques to detect such stealthy threats effectively.
