Loading story…
Researchers reported that Shadow hVNC is being used as a stealthy Windows remote access trojan that creates a hidden desktop, letting attackers interact with an infected system without moving the victim’s visible mouse or exposing on-screen activity. The malware is designed to steal browser cookies, saved passwords, cloud and financial credentials, cryptocurrency wallet data, chat sessions, VPN settings, and session tokens, and it can hijack active browser sessions through a Backstage mode that reuses the victim’s real browser profile. Malbear Labs linked a related Shadow Loader to malspam campaigns using fake copyright notices aimed at business-page administrators.
The latest reported build is a 16.4 MB Go-based payload with multiple persistence options, including services, Run keys, scheduled tasks, and a watchdog process, and it can dump LSASS memory when running with administrator privileges. Published indicators and artifacts tie the malware to copied browser databases such as Login Data.rxcopy, Cookies.rxcopy, and cookies.sqlite.rxcopy, along with exfiltration and command-and-control infrastructure including WebSocket and HTTP endpoints and activity associated with 212.162.150.121. Defenders were advised to isolate affected hosts, hunt for the malware’s file names, mutexes, hidden desktop names, and scheduled tasks, and revoke active sessions rather than relying only on password resets.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
Malbear Labs reported on Shadow hVNC and the related Shadow Loader, describing the latest build as a 16.4 MB Go-based payload and documenting its hidden-desktop, credential theft, persistence, and LSASS-dumping capabilities. The research also linked a related loader to malspam using fake copyright notices aimed at business-page administrators and published indicators of compromise and infrastructure details.
An account using the name RemoteX advertised the Shadow hVNC stealer on a criminal forum. This is the earliest explicitly dated event tied to the malware's public criminal-market activity.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
cryptika.com
Open sourcecybersecuritynews.com
Open sourcemalbearlabs.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed **MedusaHVNC**, a malware-as-a-service remote access trojan that gives attackers covert control of infected Windows systems by creating an invisible desktop and launching legitimate browsers outside the victim’s view. The malware lets operators abuse the victim’s existing browser profiles, cookies, and live authenticated sessions, making malicious activity appear to come from the user’s own device. Analysts said the payload supports typical hidden VNC functions including screen capture, synthetic keyboard and mouse input, window interaction, and clipboard access, with references to **Chrome**, **Edge**, and **Firefox**. Analysis of a recent sample found a five-stage infection chain starting with `wscript.exe` running an obfuscated JScript launcher, followed by files dropped into the **TEMP** directory, persistence via a **Startup**-folder batch file, and AutoIt-based components that inject a loader into `charmap.exe` before unpacking the final unsigned 64-bit payload. The malware contains the **MedusaHVNC** family string and communicates over a custom TCP protocol with a hard-coded command-and-control server at `51.89.204.28:4444`. Researchers said defenders should focus on outbound traffic monitoring, blocking known infrastructure and file hashes, and watching for unexpected data exfiltration because stolen information must still leave the network.
Jul 29, 2026
Researchers have identified **STX RAT**, a newly observed remote access trojan that pairs credential theft with **hidden virtual network computing (HVNC)** to let attackers control infected Windows systems without visible on-screen activity. The malware was seen in early 2026 delivered through a browser-downloaded VBScript chain that launched JScript, fetched a TAR archive, and used a PowerShell loader for in-memory injection; a separate campaign used trojanized **FileZilla** installers. Analysis found anti-analysis checks for **VirtualBox**, **VMware**, and **QEMU**, along with a random-delay “jitter exit” and an **AMSI ghosting** technique that patches a Windows RPC function to reduce detection. STX RAT communicates with command-and-control infrastructure at `95.216.51.236` using **X25519 ECDH** and **ChaCha20-Poly1305** encryption, then exfiltrates host information, screenshots, and credentials from tools including **FileZilla**, **WinSCP**, and **Cyberduck**. Its HVNC capability is considered the most dangerous feature because it creates invisible desktop sessions that allow attackers to interact with the victim machine covertly. Defenders were urged to block the known C2 IP and associated Tor onion infrastructure, monitor suspicious **WScript** and **PowerShell** activity, apply available **YARA** detections, and disable **VBScript** and **JScript** where operationally possible.
Jun 29, 2026
Elastic Security Labs identified **LOBSHOT** as a malware family that combines credential theft with a hidden virtual network computing capability, allowing attackers to remotely control infected systems through **hVNC** while remaining invisible to the user. Researchers said the malware’s command-and-control traffic includes hardcoded data that can serve as a hunting signature, giving defenders a way to identify related samples and infrastructure. Follow-on analysis found code overlap with **DarkVNC**, although researchers cautioned that the similarity may reflect shared hVNC components rather than firm attribution. Additional triage linked LOBSHOT to more than **550** VirusTotal samples over the prior year, with the earliest identified specimens dating to late July 2022, indicating sustained development and operational use; extracted configurations also revealed multiple C2 IP addresses, most commonly communicating over TCP port **443**.
Aug 15, 2026