Loading story…
Researchers detailed MedusaHVNC, a malware-as-a-service remote access trojan that gives attackers covert control of infected Windows systems by creating an invisible desktop and launching legitimate browsers outside the victim’s view. The malware lets operators abuse the victim’s existing browser profiles, cookies, and live authenticated sessions, making malicious activity appear to come from the user’s own device. Analysts said the payload supports typical hidden VNC functions including screen capture, synthetic keyboard and mouse input, window interaction, and clipboard access, with references to Chrome, Edge, and Firefox.
Analysis of a recent sample found a five-stage infection chain starting with wscript.exe running an obfuscated JScript launcher, followed by files dropped into the TEMP directory, persistence via a Startup-folder batch file, and AutoIt-based components that inject a loader into charmap.exe before unpacking the final unsigned 64-bit payload. The malware contains the MedusaHVNC family string and communicates over a custom TCP protocol with a hard-coded command-and-control server at 51.89.204.28:4444. Researchers said defenders should focus on outbound traffic monitoring, blocking known infrastructure and file hashes, and watching for unexpected data exfiltration because stolen information must still leave the network.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
SecurityWeek reported on BlackFog's findings about MedusaHVNC, highlighting its use of hidden Windows desktops to invisibly launch browsers and maintain covert access while recommending detection through monitoring for unexpected data exfiltration.
BlackFog published an analysis of a newly observed MedusaHVNC malware-as-a-service remote access trojan, describing its hidden desktop technique, five-stage infection chain, and command-and-control server at 51.89.204.28:4444.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
5 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcesecurityaffairs.com
Open sourcecybersecuritynews.com
Open sourcesecurityweek.com
Open sourceblackfog.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that **Shadow hVNC** is being used as a stealthy Windows remote access trojan that creates a hidden desktop, letting attackers interact with an infected system without moving the victim’s visible mouse or exposing on-screen activity. The malware is designed to steal browser cookies, saved passwords, cloud and financial credentials, cryptocurrency wallet data, chat sessions, VPN settings, and session tokens, and it can hijack active browser sessions through a **Backstage** mode that reuses the victim’s real browser profile. Malbear Labs linked a related **Shadow Loader** to malspam campaigns using fake copyright notices aimed at business-page administrators. The latest reported build is a **16.4 MB Go-based payload** with multiple persistence options, including services, `Run` keys, scheduled tasks, and a watchdog process, and it can dump **LSASS** memory when running with administrator privileges. Published indicators and artifacts tie the malware to copied browser databases such as `Login Data.rxcopy`, `Cookies.rxcopy`, and `cookies.sqlite.rxcopy`, along with exfiltration and command-and-control infrastructure including WebSocket and HTTP endpoints and activity associated with `212.162.150.121`. Defenders were advised to isolate affected hosts, hunt for the malware’s file names, mutexes, hidden desktop names, and scheduled tasks, and revoke active sessions rather than relying only on password resets.
Aug 19, 2026
Researchers have identified **STX RAT**, a newly observed remote access trojan that pairs credential theft with **hidden virtual network computing (HVNC)** to let attackers control infected Windows systems without visible on-screen activity. The malware was seen in early 2026 delivered through a browser-downloaded VBScript chain that launched JScript, fetched a TAR archive, and used a PowerShell loader for in-memory injection; a separate campaign used trojanized **FileZilla** installers. Analysis found anti-analysis checks for **VirtualBox**, **VMware**, and **QEMU**, along with a random-delay “jitter exit” and an **AMSI ghosting** technique that patches a Windows RPC function to reduce detection. STX RAT communicates with command-and-control infrastructure at `95.216.51.236` using **X25519 ECDH** and **ChaCha20-Poly1305** encryption, then exfiltrates host information, screenshots, and credentials from tools including **FileZilla**, **WinSCP**, and **Cyberduck**. Its HVNC capability is considered the most dangerous feature because it creates invisible desktop sessions that allow attackers to interact with the victim machine covertly. Defenders were urged to block the known C2 IP and associated Tor onion infrastructure, monitor suspicious **WScript** and **PowerShell** activity, apply available **YARA** detections, and disable **VBScript** and **JScript** where operationally possible.
Jun 29, 2026
A new **DarkMe** remote-access Trojan campaign has shifted from the exploit-led delivery associated with Water Hydra to straightforward phishing. Lures disguised as image links served executable `.PIF` files, which launched a remote MSI installer and a multistage Visual Basic 6 loader chain. The chain registers a COM object and invokes it through `rundll32.exe /sta {CLSID}`, checks for sandbox-like processes, creates persistence through a custom `Locked://` URI handler, and process-hollows the signed Microsoft `clspack.exe` binary. The final payload combines remote-access and infostealing functions: it can collect cryptocurrency-wallet data, take screenshots, enumerate installed antivirus products, manipulate files, and run commands. It communicates over custom TCP command-and-control on port `7712`; observed infrastructure included `thatawful[.]boutique` resolving to `67.43.50[.]11:7712`. Organizations should block the identified infrastructure, investigate `.PIF` downloads and suspicious remote MSI execution, and hunt for the `rundll32.exe /sta` COM-launch pattern and unauthorized `Locked://` registry protocol handlers.
Sep 25, 2026