MedusaHVNC Hijacks Real Browsers on Hidden Windows Desktops
Researchers warn the newly documented MaaS remote‑access trojan uses layered obfuscation and a fixed command server so defenders must rely on network controls to detect and block it.
Overview
- Security researchers reconstructed a five‑stage infection chain that begins with an obfuscated JScript run by wscript.exe, drops an AutoIt interpreter, and gains persistence via a Startup .bat before injecting a loader into charmap.exe.
- The final unsigned x86‑64 payload contains the family string 'MedusaHVNC' and a hardcoded command‑and‑control address at 51.89.204.28:4444 which the malware uses for operator connections.
- MedusaHVNC spins up a real browser inside a hidden Windows desktop and loads the victim’s browser profile, giving operators access to cookies, session state, and logged‑in accounts without the user seeing any window.
- The malware relies on normal Windows APIs for screen capture, synthetic input, and clipboard access and uses layered unpacking (single‑byte XOR, 16‑byte repeating XOR, then ChaCha20) to frustrate detection and analysis.
- Researchers and reporters advise defenders to block the known C2 and file hashes, monitor outbound connections and data exfiltration, and correlate unusual AutoIt/charmap.exe behavior with SaaS activity because endpoint API calls alone are noisy.