Cybersecurity researchers have uncovered a feature-rich malware strain called Shadow hVNC that gives attackers control of a hidden Windows desktop on an infected system.
Unlike conventional remote-access tools, the malware creates a separate desktop session where criminals can launch browsers, execute programs, steal data, and interact with online accounts without displaying activity on the victim’s screen.
Shadow hVNC was advertised on an underground forum in March 2026 as a stealer and hidden virtual network computing tool.
The analyzed version 5.5 is a 16.4 MB Go-based payload with remote administration, credential theft, browser-session hijacking, persistence, proxying, and surveillance capabilities.
Although several advertised functions were found to be defective, its hidden-desktop component remains a serious risk.
Shadow hVNC Enables Invisible Desktops
The malware creates a second Win32 desktop named RemoteXHidden using the Windows CreateDesktopW API. It then assigns a dedicated worker thread to that desktop through SetThreadDesktop.
Programs launched by the attacker including Chrome, Command Prompt, PowerShell, or additional malware run inside this separate environment rather than on the user’s visible Windows desktop.
This design allows attackers to work in parallel with the victim. A user may continue using their computer normally while the operator opens websites, runs commands, and browses files in the hidden session.
Shadow hVNC captures the hidden desktop and streams it to the attacker through WebSocket connections, using JPEG dirty-rectangle updates or H.264 video compression to reduce bandwidth use.
The malware also receives attacker mouse clicks and keystrokes, then injects them into hidden windows. Since the actions occur on the alternate desktop, the victim does not see browser windows, command shells, login pages, or file-management activity.
Shadow hVNC includes a “Backstage Mode” that is especially dangerous for account takeover. When enabled, it launches a browser against the victim’s existing browser profile.
The malware can inject stolen cookies into the hidden browser using Chrome DevTools Protocol, allowing attackers to access webmail, financial services, corporate portals, and other accounts through already-authenticated sessions.
This may help criminals bypass password prompts and multi-factor authentication challenges. However, the Backstage Mode can visibly disrupt the victim.
The malware kills the victim’s Chrome processes to gain exclusive access to the active browser profile, potentially causing Chrome to crash repeatedly or refuse to stay open, malbearlabs said.
Indicators of Compromise
| IOC type | Indicator | Detection relevance |
|---|---|---|
| Hidden desktop | RemoteXHidden | Name of the alternate Win32 desktop used for invisible attacker activity |
| Hidden desktop | RemoteXBackstage | Desktop associated with Backstage browser sessions |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN. Gain complete phishing visibility to strengthen your SOC and reduce MTTR
