A Stealthy RAT Hides in Plain Sight: MedusaHVNC Malware Uses Hidden Windows Desktops to Evade Detection
A sophisticated remote access trojan (RAT) has been discovered using a legitimate Windows feature to evade detection and remain hidden from users. MedusaHVNC, sold as malware-as-a-service (MaaS), is promoted through its own website and Telegram channel, and was analyzed by cybersecurity researchers at BlackFog. The findings reveal a 5-stage infection chain that uses a combination of encryption and Windows functions to stay under the radar.
At its core, MedusaHVNC operates from a hidden virtual network computing (HVNC) module, which opens a legitimate browser on a separate, invisible Windows desktop. This allows the attacker to use Windows tools such as BitBlt, EnumWindows, and PrintWindow without being observed by the user. The malware also uses clipboard functions to move information in and out of the session, making it a stealthy and persistent RAT.
The infection chain begins when the legitimate wscript.exe executes a JScript launcher, which waits for just over 7.5 seconds before building its embedded files under %TEMP%\Nx2981Okkr2\. Several files are written to disc, including an encrypted payload and a .bat in the Startup folder to maintain persistence. Windows AutoIT is used to decrypt the payload, and the loader contains two further layers of encryption: a 16-byte repeating XOR operation and ChaCha20 decryption with a 32-byte key.
The installed final payload is an unsigned PE32+ x86-64 console executable containing a .pay section and the family string MedusaHVNC. It communicates with the operator’s command and control (C2) server at a hardcoded address: 51.89.204.28:4444. The attacker can create a browser of choice within the hidden desktop from Chrome, Edge, and Firefox.
The discovery of MedusaHVNC highlights the ongoing cat-and-mouse game between cybercriminals and cybersecurity researchers. As legitimate Windows features are increasingly used to evade detection, it’s essential for users to stay vigilant and implement robust security measures. The only obvious mitigation is detection of unexpected data exfiltration, which can indicate that something is amiss.
In this case, the hidden desktop allows the attacker to take full advantage of legitimate Windows tools without being observed by the user. However, even if the RAT’s operation is out of view in the unknown and hidden desktop, the data must still be exfiltrated from the network. Detection of unexplained data leaving the network is always an indication that something is wrong somewhere.
To protect themselves, users should remain cautious when interacting with unfamiliar websites or software, and implement robust security measures such as regular backups, strong antivirus solutions, and a secure firewall configuration. Early detection and response to potential security threats can help prevent the spread of malware like MedusaHVNC.
Source: SecurityWeek — 2026-07-27