What's Going On?
Imagine this: you're sitting at your computer, composing emails, surfing the web, opening a bank account to check the balance. Everything is normal. No strange windows pop up. There are no signs that the device is slowing down. Task Manager is clean. Antivirus is silent.
But right at that moment — on that same computer — someone is opening another Chrome session, logging straight into your bank account with the same active session, browsing your email, copying data to the clipboard, and you... don't see anything. Not a single pixel appears on the screen you are looking at.
Sounds like a science fiction movie? Are not. This is exactly what MedusaHVNC is doing in real life, right now, in July 2026.
This malware doesn't steal passwords and then log back in remotely — it sits at your desk, on a screen that only the attacker sees. It bypasses two-factor authentication (2FA) because there's no need to log in — your login session is already there. And even scarier: it only uses legitimate Windows tools available, making most security solutions completely... blind.
Sold as a service (Malware-as-a-Service) on underground forums, MedusaHVNC does not require the buyer to be an expert — just money, can turn anyone into a victim.
This analysis will "dissect" MedusaHVNC from A to Z: how it infiltrates through 5 stages, how it hides in charmap.exe — yes, that Character Map you never use, how it creates an invisible desktop, and most importantly — the only Achilles heel you can exploit to detect it.
Threat Overview
| Attribute |
Details |
| Malware Name |
MedusaHVNC |
| Malware Type |
Remote Access Trojan (RAT) with Hidden Virtual Network Computing (HVNC) capabilities |
| First Identified |
July 27, 2026 |
| Distribution Model |
Malware-as-a-Service (MaaS) |
| Target Platform |
Microsoft Windows (x64) |
| Payload Architecture |
Unsigned 64-bit Portable Executable (PE) |
| Command-and-Control (C2) |
51.89.204.28:4444 |
| C2 Communication Protocol |
Custom protocol over native Windows networking APIs |
| Primary Analysis Sources |
BlackFog, SecurityWeek, SecurityAffairs |
Chain of Contagion
To successfully put MedusaHVNC into the computer and hide, the attacker designed an extremely elaborate "delivery" journey consisting of 5 steps. They were like a group of professional thieves: they didn't break in the door, but disguised themselves as delivery men, used fake keys, and slowly disabled the alarm system.
Below is a diagram summarizing that journey:
Step 1: "Impostor Knocks" and the Sandbox trick
It all started when the victim accidentally ran a script file (JScript). This file is executed by the Windows Script Host system (wscript.exe). However, it does not act immediately. Instead, it "stood still" for exactly 7,584 seconds (more than 7.5 seconds). Why this strange number? In the security world, Sandbox systems (simulated environments to test malicious code) often only monitor a file for the first few seconds. By "playing dead" for 7.5 seconds, this script fooled the security system into thinking it was a safe file, before silently waking up and continuing.
Step 2: Build a "secret base" to set up a permanent base
After bypassing the protection system, the script begins building the base. It sneaks into the Windows temporary folder (%TEMP%) and creates a secret folder named Nx2981Okkr2. Here, it silently gathers "tools" including:
A legitimate automation software called AutoIt (as a licensed tool, no one suspects).
A configuration file.
The core of the malicious code itself (which is currently encrypted and the extension is hidden to avoid being noticed).
In particular, it secretly inserts a piece of code (batch script) into the Startup folder of the computer. Thanks to that, even if the victim restarts the computer, the malicious code will still run automatically.
Step 3: Use legitimate software to do shady work (AutoIt Decryption)
The attacker is very smart not to manually unlock the malware core. They are "thanks" to AutoIt — a tool used by system administrators to automate work. Because AutoIt is clean and reliable software, antivirus software will ignore it. AutoIt then receives the command, using a simple key (XOR key 0xAE) to decrypt the first shell of the payload block, creating an executable program (64-bit executable).
Step 4: "Enter the soul and take the body" (Process Injection)
This is the most sophisticated step. To have a safe haven, the malicious code just created by AutoIt does not operate on its own. Instead, it targets charmap.exe — which is the most innocuous, boring, built-in Character Map utility on any Windows computer. The malicious code "injects" itself entirely into the charmap.exe process. If you open Task Manager to check if there is anything unusual on your computer, you will only see charmap.exe running. There's nothing suspicious, and you'll ignore it. This technique of using system software to do bad things is called Living-off-the-Land (LOLBin).
Step 5: Remove the last 3 layers of cover
Even after getting inside charmap.exe, the core of the malware is still not revealed. It protects itself with 3 consecutive layers of encryption keys:
First, it uses a 16-byte XOR algorithm to scan through and decode more than 1 million bytes of data.
Next, it uses another strong encryption algorithm, ChaCha20.
Finally, the cover broke.
Only at this moment did the monster MedusaHVNC truly wake up and begin to erect an invisible Desktop screen. This entire 3-layer decoding process is intended to frustrate and slow down the progress of security researchers trying to dissect it.
Core Operating Mechanism — Hidden Desktop
What is HVNC?
Hidden Virtual Network Computing (HVNC) is a technique that allows creating a second Windows desktop that is completely hidden. While the victim is still working normally on the main desktop, the attacker operates in parallel on the hidden desktop without any signs on the victim's screen.
Take advantage of live browser sessions
This is the most dangerous point of MedusaHVNC:
Malicious code runs browsers (Chrome, Edge, Firefox) on hidden desktops
This browser inherits the victim's entire login session
An attacker can:
Access the bank account you are logging in to
Read emails without knowing the password
Operations on active web applications
Steal cookies, session tokens, saved passwords
Perform fake financial transactions
Unlike traditional keyloggers or stealers that need to steal credentials and then log in again, MedusaHVNC directly uses the current login session — completely bypassing previously authenticated 2FA/MFA.
Detailed Technical Analysis
To create a "parallel universe" right on the victim's computer, MedusaHVNC does not use magic. It simply excellently "circumvents the law" by abusing the legal tools that the Windows operating system provides to software developers.
Legal Weapons: Windows API set
Instead of writing malicious code that can easily be caught by anti-virus software, the person behind MedusaHVNC only calls API functions available in the Windows library. These are the functions that applications like TeamViewer or Zoom use every day:
| API Function Name |
Role in the Windows System |
How MedusaHVNC Abuses It |
| CreateDesktopW / OpenDesktopW |
Allows Windows to create and manage separate desktop environments (e.g., the lock screen or logon screen). |
Creates a hidden desktop: Establishes a completely new desktop that is not attached to the user's physical display. This isolated environment is where all malicious activities take place. |
| BitBlt / PrintWindow |
Enables applications to capture screenshots or copy graphical content between windows. |
Streams the hidden desktop: Continuously captures the contents of the hidden desktop, packages the images, and transmits them over the network so the attacker can monitor the session in real time, similar to a live video stream. |
| EnumWindows |
Enumerates all top-level windows currently open on a desktop so they can be managed by the operating system or applications. |
Manages hidden desktop windows: Allows the attacker to identify which applications (e.g., web browsers or Windows Explorer) are running on the hidden desktop. |
| SendInput / SetWindowsHookExW |
Allows software to simulate keyboard and mouse input (commonly used by automation tools, macros, or accessibility software). |
Provides remote control: Receives commands from the attacker (mouse movement, clicks, and keystrokes) and injects them directly into applications running on the hidden desktop. The victim does not see any mouse movement or keyboard activity on their visible desktop. |
| OpenClipboard / SetClipboardData |
Manages the system clipboard used for copy-and-paste operations. |
Enables instant data manipulation: Allows the attacker to copy malicious commands or scripts into the victim's hidden session, or retrieve sensitive data copied within that session via the clipboard. |
The Art of Combination
The danger does not lie in each individual API function, but in the way this malware combines them (Orchestration). Here's how they work together:
Why are security shields (EDR/AV) "blind"?
Traditional Endpoint Detection and Response (EDR) or Antivirus (AV) solutions face extremely difficulties in catching MedusaHVNC in the act for the following 4 core reasons:
No "hot weapons" (No Malicious APIs): EDR often alarms when it sees software trying to delete system files, edit the Registry illegally, or encrypt disks (like Ransomware). MedusaHVNC does not do that. It only uses graphics processing functions (BitBlt) and mouse emulation (SendInput). To EDR, this looks exactly like legitimate remote support software.
Parasite on clean process (Process Injection): Recall Step 4 in the Infection Chain, this malicious code injects its code directly into the charmap.exe process (Character Map). charmap.exe is a file with a valid Microsoft digital signature (Signed Binary). When EDR checks who is calling those API functions, it sees charmap.exe calling. Trust in a core file system causes EDR to bypass strict scrutiny.
The malicious code resides entirely in memory (Fileless / In-Memory): MedusaHVNC's core is never written to the hard drive (Disk) in the form of a file ending in .exe or .dll. It is decoded directly into the RAM (Memory) of the charmap.exe process. Therefore, Antivirus scanners that periodically scan the hard drive will never find it.
The physical desktop is completely quiet: Because all operations are routed by the Windows system to a second desktop that is not displayed, the user's physical mouse does not jerk, the keyboard does not panic, and the screen does not flicker. Victims have no reason to call the IT team for support.
Command & Control Infrastructure (C2)
| Attribute |
Value |
| IP Address |
51.89.204.28 |
| Port |
4444 |
| Protocol |
Custom protocol (not HTTP/HTTPS) |
| Configuration |
Hardcoded in the binary (no dynamic resolution) |
Hardcoding the C2 address is a double-edged sword: simple for attackers to operate, but also a stable target that defenders can block immediately.
Indicators of Compromise (IOCs)
Network IOCs
| Type |
Value |
Description |
| C2 IP |
51.89.204.28 |
Command & Control server |
| C2 Port |
4444 |
Communication port |
Host-based IOCs
| Type |
Value |
Description |
| Temp Folder |
%TEMP%\Nx2981Okkr2 |
Malware staging directory |
| Startup Persistence |
Batch script in the Startup folder |
Automatic startup persistence mechanism |
| Process |
charmap.exe spawned by AutoIt |
Target process used for process injection |
| Internal String |
MedusaHVNC |
Embedded string within the final payload |
| XOR Key (Stage 3) |
0xAE |
Single-byte XOR decryption key |
| Encryption (Stage 5) |
ChaCha20 (32-byte key, 12-byte nonce) |
Used to decrypt the final payload |
MITRE ATT&CK Mapping
| Tactic |
Technique |
MITRE ATT&CK ID |
Details |
| Execution |
Windows Script Host |
T1059.007 |
JScript launcher executed via wscript.exe. |
| Execution |
AutoIt Scripting |
T1059 |
Uses the AutoIt interpreter to decrypt and execute the payload. |
| Persistence |
Startup Folder |
T1547.001 |
Achieves persistence by placing a batch script in the Windows Startup folder. |
| Defense Evasion |
Process Injection |
T1055 |
Injects malicious code into charmap.exe. |
| Defense Evasion |
Obfuscated Files or Information |
T1027 |
Employs multi-layer obfuscation using XOR and ChaCha20 encryption. |
| Defense Evasion |
Sandbox Evasion |
T1497 |
Delays execution for 7,584 ms to evade automated analysis environments. |
| Defense Evasion |
Masquerading |
T1036 |
Abuses a signed Windows system binary (LOLBin) to appear legitimate. |
| Collection |
Screen Capture |
T1113 |
Captures the hidden desktop using BitBlt and PrintWindow. |
| Collection |
Input Capture |
T1056 |
Captures or injects user input via SetWindowsHookExW. |
| Collection |
Clipboard Data |
T1115 |
Accesses clipboard contents using OpenClipboard and GetClipboardData. |
| Command and Control (C2) |
Non-Standard Port |
T1571 |
Communicates over TCP port 4444. |
| Command and Control (C2) |
Non-Application Layer Protocol |
T1095 |
Uses a custom binary protocol instead of standard application-layer protocols. |
| Impact |
Valid Accounts |
T1078 |
Hijacks active browser sessions to gain unauthorized account access. |
Defense Recommendations
Block C2 IP 51.89.204.28 on firewall/IPS/proxy
Block port 4444 for outbound traffic (if not needed)
Deploy IOC to SIEM/EDR/Threat Intelligence platform
Scan the entire system with the updated endpoint security solution
Check Task Scheduler for unusual or hidden scheduled tasks
Check Startup folder for batch scripts of unknown origin
Long-Term Prevention
| Mitigation |
Description |
Priority |
| Anti-Data Exfiltration (ADX) |
Monitor and block abnormal outbound network connections, regardless of which process initiates them. |
High |
| Application Whitelisting |
Allow execution only for approved applications and block AutoIt if it is not required in the environment. |
High |
| Network Segmentation |
Restrict outbound network traffic to only approved IP addresses and domains. |
Medium |
| EDR with Behavioral Analysis |
Deploy an Endpoint Detection and Response (EDR) solution capable of detecting process injection and HVNC-related behaviors. |
High |
| Credential Hygiene |
If compromise is suspected, reset all credentials, invalidate active sessions, and revoke authentication tokens immediately. |
High |
| Browser Session Management |
Avoid storing passwords in web browsers; instead, use a dedicated password manager. |
Medium |
Monitoring charmap.exe |
Generate alerts when charmap.exe establishes network connections or is spawned by a parent process other than explorer.exe. |
Medium |
Weaknesses of Malware
MedusaHVNC represents an extremely dangerous evolution in the way malware steals data. It completely abandons old methods (such as installing keyloggers or stealing password files) to choose a stealth path: using the operating system's own legitimate tools to "sit at the same table" with the victim.
By combining:
HVNC technology creates invisible desktops.
Living-off-the-Land technique (using charmap.exe and legal API).
The MaaS model makes it possible for any "apprentice" hacker to buy and use.
MedusaHVNC has made Antivirus systems (based on pattern recognition) and some EDR systems (based on process behavior) helpless.
References
MedusaHVNC Malware Uses Hidden Windows Desktops to Evade Detection
MedusaHVNC Trojan Creates Hidden Desktops to Hijack Browsers and Steal Data
MedusaHVNC: A Hidden Desktop
