Shadow hVNC Malware Kit Gives Hackers Hidden Windows Desktop for Covert Remote Control

Gbhackers •Mayura Kathir • August 18, 2026

A newly advertised malware-as-a-service toolkit named Shadow hVNC combines browser credential theft, hidden virtual desktop control, reverse proxying, and extensive persistence into a single Windows-focused payload. Marketed by a user known as “RemoteX” in March 2026, the kit gives operators a parallel Win32 desktop where they can browse, run tools, and interact with hijacked sessions […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Shadow hVNC Malware Enables Covert Remote Control for Cybercriminals The Shadow hVNC malware kit, launched in March 2026 by a user named 'RemoteX', allows hackers to gain hidden control over Windows desktops without the victim's awareness. This malware-as-a-service combines features like browser credential theft, reverse proxying, and extensive persistence. It creates a separate Windows workspace for attackers, enabling them to monitor and interact with hijacked sessions discreetly. Victims are primarily Windows users, with the malware capable of stealing sensitive information such as browser cookies, saved passwords, and financial data. The kit's capabilities pose a significant risk to individual users and organizations alike. As of today, there are no known patches or mitigations available for this threat. 2 sources 65

Extracted Entities

Shadow hVNC Malware Kit Gives Hackers Hidden Windows Desktop for Covert Remote Control

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (1)