When a piece of malware uses nothing but legitimate Windows APIs and runs inside a trusted system binary, standard process monitoring offers little protection
Security researchers at BlackFog recently cracked open a new remote access trojan sold as malware-as-a-service that does exactly that, exploiting Windows hidden desktop capabilities to let attackers browse the web on a victim’s machine without the victim ever seeing what is happening
MedusaHVNC, as the trojan is called, pushes past the usual credential-stealing playbook
Rather than scraping stored passwords, it launches a fully functional browser inside a Windows desktop the user cannot see, loading existing browser profiles that already contain logged-in sessions
The victim’s IP address stays the same, and the operating system keeps reporting normal process activity, because every function the malware calls — BitBlt for screen capture, SendInput for keystrokes, EnumWindows for window management — has a legitimate purpose in remote support and automation software
The trojan’s client console supports Chrome, Edge, Brave, Firefox, and Telegram sessions, with in-memory execution of .NET and native payloads alongside AMSI and ETW bypass capabilities
Operators select a target browser and configure the session before launch, turning account takeover into a point-and-click workflow
BlackFog’s breakdown of the infection chain reveals evasion tactics layered at every stage
The initial JScript launcher pauses for 7,584 milliseconds, a delay aimed specifically at sandbox environments that close a sample after a short observation window
From there the malware passes through an AutoIt interpreter that decrypts and injects the payload into charmap.exe — the Windows Character Map utility, a binary present on every Windows system that no security tool would flag as suspicious
The loader then runs two more decryption passes, a repeating XOR and a ChaCha20 step, before the final MedusaHVNC executable surfaces
The binary talks to a static command server at.
