- A new Windows remote access trojan can open Chrome, Edge, or Firefox on a hidden desktop.
- The malware can interact with browser sessions that may already contain active cookies and login sessions.
- Researchers found a five-stage infection chain that uses trusted Windows tools to hide the malware’s activity.
Cybersecurity researchers have uncovered a new remote access trojan called MedusaHVNC. The malware can control browsers from a hidden Windows desktop.
The malware works quietly in the background while the computer owner uses the visible desktop. The user may not see the browser that the attacker controls.
BlackFog analysed a MedusaHVNC sample and found that attackers sell it as malware-as-a-service. The malware includes a hidden virtual network computing module, known as HVNC.
The module lets attackers open Chrome, Edge, or Firefox inside a separate Windows desktop. That desktop stays hidden from the person using the computer.
The hidden browser still runs on the victim’s computer. It may also use an existing browser profile with cookies and active login sessions.
That feature could give attackers access to accounts that are already signed in. The activity could also appear to come from the victim’s normal computer.
Malware Uses Five-Stage Infection Chain
BlackFog found that the analysed MedusaHVNC sample uses five main stages before the hidden desktop becomes active. The attack begins when Windows Script Host runs an obfuscated JScript launcher.
The script then waits for 7,584 milliseconds before rebuilding embedded files. The files appear inside a temporary folder called Nx2981Okkr2. The malware then writes several other components onto the computer.
One component uses AutoIt, a legitimate Windows automation tool, to decrypt the malware. The setup also places a batch file inside the Startup folder. That file helps the malware run again when the computer restarts.
The AutoIt stage then launches charmap.exe, Microsoft’s built-in Character Map utility. The malware uses that trusted Windows program as a host for its next stage. It then uses two more encryption layers before recovering the final payload.
The first layer uses a repeating XOR operation. The second layer uses ChaCha20 to decrypt the remaining data. BlackFog recovered the final payload after analysing the encryption process. The researchers found that the payload communicates with a command server at 51.89.204.28:4444.
The malware also contains functions for screen capture and window control. Other functions can simulate keyboard and mouse actions on the hidden desktop. The sample also includes clipboard functions.
These functions can move information into or out of the hidden browser session. According to SecurityWeek, the malware uses normal Windows functions for screen and window capture. These include BitBlt, EnumWindows, and PrintWindow.
The report also links SendInput and SetWindowsHookExW to simulated input and interaction. Clipboard functions include OpenClipboard, GetClipboardData, and SetClipboardData.
Hidden Browser Sessions Create Account Risks
The hidden desktop gives attackers a way to control a browser without showing the activity on screen. BlackFog said the browser can load an existing profile with cookies and session information.
That could allow an attacker to interact with accounts that remain logged in. The risk could affect email, social media, work services, shopping accounts, and other websites. However, the analysed sample does not prove that every password or cookie gets stolen.
The actual impact would depend on what the attacker accessed. It would also depend on which session information was available on the infected computer. The malware’s use of trusted Windows features may also make detection harder.
Security tools could see normal system programs instead of an obviously harmful application. The attack chain can therefore hide behind several ordinary Windows components. This makes the full process, rather than one file, important during an investigation.
Gridinsoft noted that security teams should compare suspicious files with process activity and network connections. They should also review unexpected account activity when investigating a possible infection.
The researchers also said the malware must still communicate with its operator. It must send commands and possibly stolen information outside the infected computer.
That network activity creates a possible detection point for defenders. BlackFog recommends blocking known command servers and watching for unexpected outgoing connections.
Researchers Warn of Stealthy Remote Control
MedusaHVNC shows how attackers can misuse legitimate Windows features for hidden remote access. The malware does not need to place a browser window directly in front of the victim. Instead, it can create another desktop and keep the browser session away from view.
The operator can then interact with the browser from that hidden environment. The victim can continue using the main desktop without seeing the attacker’s browser.
SecurityWeek described MedusaHVNC as a persistent remote access trojan sold through a malware-as-a-service operation. The report said the malware’s hidden desktop gives attackers covert access to Windows systems.
BlackFog’s analysis also found that the malware supports Chrome, Edge, and Firefox. The criminal service model is expanding, a new ransomware group is recruiting affiliates with a 70% ransom share. Its operator panel provides controls for the hidden desktop session and browser activity.
The findings come from an analysis of the MedusaHVNC sample. They do not show how many victims may have been infected or confirm a specific victim list. For defenders, the researchers point to network traffic as an important place to look.
Even when the browser stays hidden, the attacker still needs communication with the infected computer. Security teams can therefore watch for unexpected connections and block known command-and-control infrastructure. They can also investigate suspicious process chains involving JScript, AutoIt, and charmap.exe.
MedusaHVNC’s main danger comes from combining hidden browser control with existing login sessions. The approach can move an attack away from the visible screen while using familiar Windows features. That makes the malware another example of how attackers can turn normal computer functions into tools for covert access.
