Shadow hVNC Malware Kit Gives Hackers Hidden Windows Desktop for Covert Remote Control

A newly advertised malware-as-a-service toolkit named Shadow hVNC combines browser credential theft, hidden virtual desktop control, reverse proxying, and extensive persistence into a single Windows-focused payload.

Marketed by a user known as “RemoteX” in March 2026, the kit gives operators a parallel Win32 desktop where they can browse, run tools, and interact with hijacked sessions without displaying activity on the victim’s visible screen.

Unlike conventional remote-access trojans that manipulate the active desktop, Shadow hVNC creates a separate desktop object named RemoteXHidden through the Windows CreateDesktopW API.

A dedicated worker thread is attached to that desktop, allowing the malware to launch Chrome, PowerShell, command shells, or secondary payloads outside the user’s view.

Operator input is injected into the hidden session, while screen content is streamed back using JPEG dirty-rectangle updates or H.264 encoding.

The most concerning component is its “Backstage Mode,” which attempts to open a browser against the victim’s live Chrome profile.

This enables an attacker to inherit active cookies, authenticated sessions, and browser state rather than stealing a password and attempting a new login.

The malware can also inject harvested cookies into a hidden browser via Chrome DevTools Protocol’s Network.setCookies method, potentially enabling direct access to email, enterprise SSO, cryptocurrency, gaming, and financial accounts.

Collectors target Chromium and Gecko browser data, Windows Vault entries, Telegram sessions, Discord tokens, Steam files, crypto-wallet artifacts, VPN configurations, cloud credentials, SSH material, password-manager data, and two-factor recovery-code files.

It also searches documents for identity and financial keywords, while a keylogger and clipboard monitor support ongoing collection.

Shadow hVNC Malware Kit

The payload’s reconnaissance functions are equally invasive. It gathers local users, administrator groups, mapped drives, ARP caches, saved credentials, RDP history, installed software, running processes, environment variables, active sessions, Wi-Fi profiles, and browser fingerprinting data.

In Active Directory environments, it can search SYSVOL-style locations for Group Policy Preferences password files and decrypt legacy cpassword values, a capability that could expose reused administrative credentials.

Medium Researchers said that, Shadow hVNC also integrates an LSASS dumping chain using an embedded utility named lss.exe. On standard credential-dumping APIs, the tool resolves Windows system calls dynamically and uses indirect syscalls to read LSASS memory.

A map[string]bool from thirteen 2-letter keys read straight out of a 26-byte run in .rdata, which means the excluded countries are recoverable byte-for-byte: ZA, RU, UA, BY, KZ, UZ, TM, TJ, KG, AZ, AM, GE, MD.

It then constructs a minidump-style file for offline parsing by the operator. The feature requires elevated privileges, but the malware contains multiple UAC-bypass attempts and Defender-exclusion routines intended to improve its chances of operating with administrative rights.

The kit can register a service masquerading as “mouse driver service,” write Run-key and logon-script entries, create Startup-folder shortcuts, schedule recurring tasks, modify PowerShell profiles, and deploy a watchdog process that relaunches the main payload.

Branded “Sheets Portal”, it reimplements a Google Sheets-style interface on a database backend, with Vietnamese UI labels.

Elevated infections add machine-wide persistence under HKLM, ProgramData, and SYSTEM-level scheduled tasks.

Defenders should prioritize hunting for the hidden desktop name RemoteXHidden, browser database copies ending in .rxcopy, suspicious WindowsSystemComponent.lnk shortcuts, scheduled tasks under Microsoft\Windows\ManagementClient, and firewall rules named RemoteX Client.

Repeated termination of user Chrome processes is another strong behavioral indicator, as Backstage Mode kills the victim’s browser to seize exclusive control of its profile.

While several advertised functions appear flawed including a DNS-based banking watcher with an incorrect ETW keyword mask the working hVNC, cookie replay, browser takeover, credential theft, and persistence capabilities make Shadow hVNC a serious threat to Windows users and enterprise environments.

Indicators of Compromise

Hash (MD5)	1d04536714bb22a3e909525a7dd627f0	ChromeElevator v0.20.0 injector (chrome_injector.exe)
Hash (MD5)	85c5a390f17891eee01d5fd10f20a98d	Dropped LSASS dumper (lss.exe)
IP	195.3.221[.]225	Shadow HVNC
IP	62.60.226[.]253	Shadow HVNC
IP	206.245.165[.]43	Shadow Loader C2 (hardcoded default)
IP	2.26.252[.]145	Shadow Loader C2

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

[Live Webinar] Join Elastic & UnderDefense to learn how small security teams can unify AI visibility and agentic response into one operating model. -> Register Now