Active threat | Endpoint detection evasion | Banking trojan family
MedusaHVNC is a remote access tool that achieves persistent, undetected browser session control by creating a second Windows desktop that remains invisible to the logged-in user. Unlike credential-stealing malware, MedusaHVNC does not need to capture passwords or intercept authentication codes. It hijacks authenticated sessions that already exist in the victim's browser profile, operating inside the trust boundary that the browser and any downstream service have already established.
How Hidden VNC creates an invisible desktop
Windows supports multiple simultaneous desktop sessions within the same user context. Legitimate uses include window station isolation and some remote desktop configurations. HVNC malware exploits this capability by creating a new, hidden desktop object that never renders on the physical monitor. The malware then launches a full browser instance in this hidden desktop, giving the attacker a functional browser window they can operate remotely through a VNC-style protocol while the victim's visible screen continues to show their normal session.
The critical operational detail is that MedusaHVNC loads the victim's existing browser profile into this hidden instance. Browser profiles contain saved cookies, session tokens, and site data. When those cookies are loaded into the hidden browser, any site that uses cookie-based session persistence treats the hidden browser as the legitimate user. No login is required. No password is captured. No MFA code is consumed. The attacker simply uses the already-authenticated session.
The five-stage infection chain
BlackFog's analysis of MedusaHVNC describes a five-stage delivery and installation process. The first stage is initial compromise, typically through phishing or malvertising delivering a dropper. The second stage is dropper execution, which installs the HVNC payload and establishes persistence through scheduled tasks or registry run keys. The third stage creates the hidden desktop environment, using Windows API calls to create a new desktop object without any visible window station association. The fourth stage launches the hidden browser instance with the victim's profile directory as its user data path. The fifth stage establishes the remote operator connection, allowing the threat actor to interact with the hidden browser session over an encrypted tunnel.
Why it bypasses traditional defenses
Password managers and credential vaults are irrelevant: the malware never touches stored credentials. MFA is ineffective for established sessions: once a session cookie exists, the MFA checkpoint has already been passed. Impossible Travel and anomalous-login detection may not trigger because the access originates from the victim's own machine, with the victim's own IP address and device fingerprint. Many AV and EDR products that monitor for suspicious browser behavior focus on processes spawning unexpected children or injecting into browser memory: a separately spawned hidden browser running normally within its own desktop object may not match those signatures.
Detection opportunities
Despite the evasion sophistication, HVNC-based attacks do leave detectable traces. At the host level, look for Windows API calls to CreateDesktop followed by browser process launches without a corresponding visible window. A second browser process running under the same user account with a different user data path argument is a high-fidelity signal. Browser telemetry that shows two simultaneous instances of the same browser with overlapping profile access is also notable.
Short-lived session token policies help at the perimeter. Configuring high-value SaaS applications to require re-authentication after a shorter idle period reduces the window of time an attacker can abuse a hijacked session. This does not stop the attack, but it limits its duration and blast radius.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if you want help reviewing your endpoint detection coverage for HVNC-style session hijacking.