Reported by 2 outlets

Timeline

1. update from gbhackers.com

   Shadow hVNC Malware Kit Gives Hackers Hidden Windows Desktop for Covert Remote Control

   gbhackers.com · 56d ago · August 18th, 2026

   A newly advertised malware-as-a-service toolkit named Shadow hVNC combines browser credential theft, hidden virtual desktop control, reverse proxying, and extensive persistence into a single Windows-focused payload. Marketed by a user known as “RemoteX” in March 2026, the kit gives operators a parallel Win32 desktop where they can browse, run tools, and interact with hijacked sessions […] The post Shadow hVNC Malware Kit Gives Hackers Hidden Windows Desktop for Covert Remote Control appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

2. update from cyberpress.org

   Shadow hVNC Lets Hackers Operate a Second Windows Desktop Invisible to the Victim

   cyberpress.org · 56d ago · August 18th, 2026

   Cybersecurity researchers have uncovered a feature-rich malware strain called Shadow hVNC that gives attackers control of a hidden Windows desktop on an infected system. Unlike conventional remote-access tools, the malware creates a separate desktop session where criminals can launch browsers, execute programs, steal data, and interact with online accounts without displaying activity on the victim’s screen. Shadow hVNC was advertised on an underground forum in March 2026 as a stealer and hidden virtual network computing tool. The analyzed version 5.5 is a 16.4 MB Go-based payload with remote administration, credential theft, browser-session hijacking, persistence, proxying, and surveillance capabilities. Although several advertised functions were found to be defective, its hidden-desktop component remains a serious risk. Shadow hVNC Enables Invisible Desktops The malware creates a second Win32 desktop named RemoteXHidden using the Windows CreateDesktopW API. It then assigns a dedicated worker thread to that desktop through SetThreadDesktop . Programs launched by the attacker including Chrome, Command Prompt, PowerShell, or additional malware run inside this separate environment rather than on the user’s visible Windows desktop. This design allows attackers to work in parallel with the victim. A user may continue using their computer normally while the operator opens websites, runs commands, and browses files in the hidden session. All the function names in cleartext (Source: