MedusaHVNC malware hijacks live browser sessions on Windows

BlackFog has identified a malware family called MedusaHVNC that can hijack live browser sessions on Windows devices, giving attackers access to active logged-in sessions through a hidden desktop.

Sold as a malware-as-a-service offering, it includes a hidden virtual network computing module that runs a browser session out of the user's sight. Because the browser runs on the victim's own machine, it can use existing profiles, cookies and session data, allowing an attacker to operate within sessions that already appear legitimate.

The finding points to a form of session theft that differs from simple credential harvesting. Rather than relying only on stolen usernames and passwords, the software appears designed to let operators work directly inside a victim's current browser environment.

How it works

According to BlackFog's analysis, the infection chain unfolds in five stages and ends with a native 64-bit payload linked to a hard-coded command-and-control server. The chain begins with obfuscated JScript executed by Windows Script Host through wscript.exe.

The script waits briefly before rebuilding embedded files in a temporary Windows directory. It then places several components on disk, including an AutoIt interpreter, a configuration file and an encrypted payload, and creates a batch file in the Startup folder to maintain persistence after a reboot.

The next phase uses AutoIt, a legitimate Windows automation tool, to decrypt the dropped payload with a single-byte XOR key. The AutoIt component runs without a visible window and produces the first native executable used in the attack chain.

Researchers found that the process then launches the Windows Character Map utility, charmap.exe, and injects the loader into the trusted system binary. Sandbox data also showed screenshot capture at that stage.

Inside charmap.exe, the loader applies two more layers of decryption before exposing the final payload. BlackFog replayed the unpacking process offline and recovered the final payload exactly.

Hidden desktop

The recovered file is described as an unsigned PE32+ x86-64 console executable containing a .pay section and the family string MedusaHVNC. It communicates over a custom TCP protocol using native Winsock functions including WSAStartup, socket, connect, send and recv.

According to the analysis, the command-and-control address 51.89.204.28:4444 is hard-coded into the binary. Browser-related strings reference Chrome, Edge and Firefox, suggesting those applications are central to the malware's intended use.

The code also includes functions associated with screen capture, window capture, synthetic input and clipboard access. These include BitBlt, EnumWindows and PrintWindow for observing activity; SendInput and SetWindowsHookExW for interaction; and OpenClipboard, GetClipboardData and SetClipboardData for moving information into or out of the session.

Taken together, those elements indicate that MedusaHVNC is built to let an operator observe and control applications inside a separate Windows desktop that the victim cannot see. In practical terms, an attacker can open and manipulate a browser session on the compromised machine while remaining hidden from the user.

Sales model

BlackFog said MedusaHVNC is promoted through a dedicated website and Telegram channel. The seller advertises features including in-memory execution of .NET and native payloads, password and cookie extraction, and support for browsers such as Chrome, Edge, Brave and Firefox, along with Telegram.

The operator panel reviewed by BlackFog appears to let users select an application and configure the hidden desktop session. In a video examined by researchers, Google Chrome is shown running inside a hidden desktop while signed in to an account, with controls for frame rate and image quality visible in the panel.

The presence of a commercial sales page and client interface highlights the continued industrialisation of cybercrime tools. MedusaHVNC appears to combine remote access, evasion techniques and session abuse in a package aimed at buyers who may not need to build malware themselves.

Defensive focus

BlackFog said outbound traffic offers a practical point for detection because the attacker must ultimately receive the hidden session from the infected endpoint. Unexpected outbound connections to attacker infrastructure remain significant regardless of the earlier delivery or evasion techniques used.

Known indicators include the command-and-control server at 51.89.204.28:4444, the temporary staging directory %TEMP%\Nx2981Okkr2\, the Startup artefact AFLlvOscPj.bat, the encrypted payload file zorsxklxfehdoals and the AutoIt configuration file wvwxrhlfxquucjpewcitbkp.cfg. The injection target identified in the analysis was C:\Windows\System32\charmap.exe.

The malware sample was also tied to several file hashes, including a SHA-256 hash for the final payload: e261888f0807b9b372b54aa45487cb5786a939fa3e87094ff270b6b8db5fdfb6.

Blocking traffic to known command-and-control infrastructure and monitoring for unusual outbound connections would provide a starting point for defenders confronting threats such as MedusaHVNC.