MedusaHVNC hides browsers on invisible desktops to stay out of sight
The RAT opens a legitimate Chrome, Edge or Firefox instance on a hidden Windows desktop, letting attackers browse, capture screens, and hijack clipboard without the user noticing. It loads via a multi‑stage encrypted payload, persists in the Startup folder, and talks to a hard‑coded C2. Detection now hinges on spotting unexplained outbound traffic.