BlackFog has identified a new remote access trojan called MedusaHVNC that can place an attacker inside live browser sessions on an infected Windows computer without showing the activity to the user.
The malware uses hidden virtual network computing, or HVNC, to create a separate Windows desktop and launch a browser there. Because that browser is still running on the victim’s device, it can load the person’s existing profile, cookies and session state. An operator can then interact with accounts that are already logged in while connections continue to originate from the compromised machine.
BlackFog examined a recovered sample alongside the malware’s sales website, Telegram channel and operator panel. The seller advertises password, cookie and browser-history extraction, along with support for Chrome, Edge, Brave, Firefox and Telegram. Those are marketplace claims. The analyzed binary itself contained browser references and the components needed to capture windows, send synthetic input and use the clipboard within a separate desktop.
The infection chain begins with obfuscated JScript executed by Windows Script Host. It writes an AutoIt interpreter, configuration data and an encrypted payload to a temporary directory, then places a batch file in the Startup folder for persistence. A later stage launches the Windows Character Map utility and injects the loader into that trusted process before two additional decryption layers expose the final 64-bit payload.
BlackFog found that the recovered payload communicates over a custom TCP protocol and contains a hard-coded command-and-control address. Windows functions in the binary support screen and window capture, input control and clipboard operations, which the researchers said are consistent with remote control of applications on the hidden desktop.
The technique targets the session after a legitimate login rather than defeating the login ceremony itself. MITRE ATT&CK notes that web session cookies can let an attacker use a service as an authenticated user and can bypass some multi-factor authentication protocols because the session has already been established. MedusaHVNC keeps that activity on the victim’s endpoint instead of importing a stolen cookie into a browser on another device.
The malware extends an identity-security problem already associated with session-token and cookie theft. It also follows a long-established pattern in which remote-access malware can undermine device-based authentication because fraudulent activity comes from the legitimate user’s computer.
BlackFog recommends blocking known command-and-control infrastructure and monitoring unexpected outbound connections. The analysis includes the command-and-control address and file hashes as indicators that defenders can use to identify or interrupt the malware’s communications.
Sources: BlackFog, MITRE ATT&CK
–
By the ID Tech Editorial Team
