MedusaHVNC Trojan Creates Hidden Desktops to Hijack Browsers and Steal Data

MedusaHVNC is a malware-as-a-service remote access trojan that abuses legitimate Windows hidden desktop functionality to launch real browsers out of view and hijack live sessions (cookies, passwords, history). The report details an infection chain (obfuscated JScript launcher → AutoIt decryption → loader injected into charmap.exe → ChaCha20-unpacked payload), in-memory execution with AMSI/ETW bypasses, HVNC capture/input techniques, baked-in C2 (51.89.204.28:4444), and mitigation guidance (block C2, file hashes, and monitor unexpected outbound connections).