BlackFog published research on July 27, 2026 exposing MedusaHVNC, a remote access trojan distributed as a malware-as-a-service operation with its own website and Telegram channel. MedusaHVNC’s defining capability is launching Chrome, Edge, or Firefox on a hidden Windows virtual desktop — an entirely separate desktop session that is invisible to the user — enabling attackers to conduct banking fraud, steal credentials, and access corporate web applications through the victim’s authenticated browser sessions without triggering any visible indication on the infected machine.
MedusaHVNC’s Hidden Virtual Desktop Technique for Browser Fraud
Hidden Virtual Network Computing attacks work by creating a parallel Windows desktop session that runs alongside the user’s visible environment. Applications running on the hidden desktop — including browsers with saved passwords and active authenticated sessions — are fully operable by the attacker through remote input and screen capture, while the victim’s display shows nothing unusual on their own desktop.
MedusaHVNC implements this technique using only legitimate Windows API calls. Screen capture on the hidden desktop uses BitBlt, EnumWindows, and PrintWindow — standard APIs shared by screenshot utilities and legitimate remote access software. Input simulation uses SendInput and SetWindowsHookExW — the same APIs used by accessibility software and authorized remote desktop products. Because every API call involved is legitimate and in common use, behavioral detection tools that flag suspicious API patterns cannot distinguish MedusaHVNC’s hidden session activity from routine Windows system operations.
This design gives attackers full access to authenticated browser sessions without needing to steal or crack credentials. Because the browser on the hidden desktop is already logged into the victim’s banking portal, email, or corporate SSO applications, attackers can execute transactions, extract data, and modify account settings — all through sessions that passed MFA before the attacker arrived. The attacker is operating inside an already-verified session, not creating a new one.
The Five-Stage Infection Chain: JScript Dropper to HVNC Module Load
MedusaHVNC’s infection proceeds in five stages. In the first stage, wscript.exe executes a JScript dropper that includes a 7.5-second delay before taking further action — a timing delay designed to bypass automated sandbox analysis environments that impose short execution time limits. The second stage places a batch file in the Windows Startup folder, establishing persistence across reboots.
In the third stage, a Windows AutoIT script decrypts the malware’s core payload. The fourth stage hollows out the legitimate charmap.exe process — a trusted Windows system utility — loading it with two sequential encryption layers: a 16-byte XOR cipher followed by ChaCha20 decryption. The HVNC module loads into memory in the fifth stage, completing the infection without writing the decrypted payload to disk in an easily detectable form.
The use of charmap.exe process hollowing follows an established pattern of embedding malicious payloads inside trusted Windows system binaries, making the running process appear legitimate to task managers and basic security inspection.
How MedusaHVNC Bypasses MFA by Controlling Already-Authenticated Sessions
MedusaHVNC’s approach to authentication and MFA bypass is architectural rather than technical. The malware does not phish credentials, intercept one-time codes, or attack authentication infrastructure directly. Instead, it waits until the victim has already authenticated — including completing any MFA challenge — and then takes control of the resulting browser session on the hidden desktop.
Once the victim logs into their bank or corporate application and the MFA is satisfied, the resulting session tokens and cookies reside in the browser’s session state. MedusaHVNC’s hidden desktop gives the attacker access to that browser session — MFA has already been completed and the session is active. This approach defeats SMS-based MFA, authenticator app codes, and push-approval MFA equally, because none of these are re-challenged during an existing authenticated session.
Detection Gaps for a RAT That Executes Only Legitimate Windows Processes
Signature-based detection faces a fundamental challenge with MedusaHVNC: the processes visible during an active attack — wscript.exe, charmap.exe, and the victim’s own browser running on the hidden desktop — are all legitimate Windows or browser binaries operating normally from a file signature and process integrity perspective. The malicious payload resides in memory after decryption and does not present as a standalone executable on disk.
The primary behavioral detection signal BlackFog identifies is unexplained data exiting the network. The hidden desktop browser generates the same categories of network traffic as normal user activity — connections to banking sites, corporate applications, and email services — but potentially at volumes, times, or patterns inconsistent with the victim’s normal behavior. Network monitoring that baselines individual endpoint outbound activity and flags anomalies in off-hours web application access or unusual data volumes provides the most reliable detection signal for HVNC-based attacks. Endpoint visibility into hidden desktop creation events through Windows API monitoring offers a complementary detection layer for organizations whose security tools have that capability.
