Shadow hVNC Gives Attackers Remote Desktop Control Without Moving the Victim’s Mouse

Cybersecuritynews •Tushar Subhra Dutta • August 18, 2026

Shadow hVNC is a remote access tool built to operate where victims cannot see it. Instead of taking over the visible desktop, it can create a separate Windows workspace and give criminals a live view of activity inside it. The malware steals browser cookies, saved passwords, financial data, and session tokens, then uses them to […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Shadow hVNC Malware Enables Covert Remote Control for Cybercriminals The Shadow hVNC malware kit, launched in March 2026 by a user named 'RemoteX', allows hackers to gain hidden control over Windows desktops without the victim's awareness. This malware-as-a-service combines features like browser credential theft, reverse proxying, and extensive persistence. It creates a separate Windows workspace for attackers, enabling them to monitor and interact with hijacked sessions discreetly. Victims are primarily Windows users, with the malware capable of stealing sensitive information such as browser cookies, saved passwords, and financial data. The kit's capabilities pose a significant risk to individual users and organizations alike. As of today, there are no known patches or mitigations available for this threat. 2 sources 65

Extracted Entities

Shadow hVNC Gives Attackers Remote Desktop Control Without Moving the Victim’s Mouse

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (2)

Platforms (1)