A new malware-as-a-service offering named Hermes has surfaced on underground forums, bundling hidden virtual desktop control, browser credential harvesting, crypto wallet theft, and remote command execution.
Phishing, malvertising, SEO poisoning, or trojan archives
Spawns hidden desktop via CreateDesktop / SetThreadDesktop
Extracts browser DBs, crypto wallets, and session tokens
Registry Run keys, scheduled tasks, and remote shell control
If your team may be exposed to a similar threat, FemtoSec can help validate blast radius, prioritize remediation, and connect the issue to a practical security program.
September 13, 2026
Underground threat actors are actively marketing a massive 543 GB archive of RedLine VIP infostealer logs containing 295,631 harvested victim records. The exfiltrated data encompasses plaintext credentials, active browser session tokens, cryptocurrency wallet keys, and sensitive enterprise system metadata.
August 6, 2026
Underground threat actors have announced the release of Anonymous Mobile RAT v6, an advanced Android Remote Access Trojan designed to capture credentials, record screens, and abuse accessibility settings, creating severe risks for enterprise mobile security.
July 25, 2026
Defenders prioritizing mobile endpoint integrity must immediately audit Android Accessibility Service authorizations to counter BTMOB RAT v4.6. This technical analysis explores the malware's delivery vectors, capabilities like 2FA bypass, and step-by-step containment protocols.
Hidden Virtual Network Computing (HVNC) architecture combined with multi-engine browser extraction represents a significant evolution in commercial infostealer design. The emergence of the Hermes stealer suite on illicit cybercrime forums highlights how malware developers are merging passive credential exfiltration with active, low-latency remote access trojan (RAT) tooling. By targeting both Chromium and Gecko browser engines alongside gaming tokens, messaging session caches, and cryptocurrency wallets, the malware equips threat actors with immediate initial access and post-exploitation capabilities.
As commoditized malware strains lower the barrier to entry for adversaries targeting enterprise assets, evaluating endpoint resilience through proactive penetration testing and robust credential hygiene becomes paramount for security operations teams.
The operational capabilities and behavior of Hermes extend well beyond conventional infostealers. While legacy stealers focus solely on collecting static flat files and browser databases for offline decryption, Hermes incorporates interactive surveillance and remote management capabilities designed to subvert user awareness and operational controls.
Hermes systematically targets identity and credential repositories stored across client endpoints. The software actively scrapes data from multiple browser architectures:
Chromium-Based Browsers: Targets Google Chrome, Microsoft Edge, Brave, Opera, and related variants to extract encrypted SQLite databases containing autofill details, saved credentials, Web Data, and active session cookies.
Gecko-Based Browsers: Scans Mozilla Firefox and derivative profiles, extracting key4.db, logins.json, and master password-protected key stores.
Cryptocurrency Wallets: Directly extracts data from more than 100 browser extension wallets, cold wallet configuration files, and local cryptocurrency management software.
Session Tokens and Communications: Collects active session tokens and local databases from communication and gaming platforms, including Discord, Telegram, and Steam.
Beyond static credential dumping, the malware exhibits dynamic behavior through real-time host monitoring. Keylogging routines intercept global keystrokes across user sessions, while clipboard monitoring intercepts sensitive data such as temporary passwords and wallet addresses during copy-paste operations. In addition, the malware incorporates GPU-accelerated screen capture routines to stream active desktop sessions directly to the operator console with low latency.
The infection chain for malware distributed under a Malware-as-a-Service (MaaS) model typically relies on diverse distribution pipelines controlled by individual threat actors. Initial execution vectors for Hermes commonly leverage malicious spam attachments, SEO poisoning leading to trojanized software installers, malvertising lures, and malicious archive distribution.
Once initial execution is achieved on the target operating system, Hermes initiates defense evasion routines by establishing an isolated virtual desktop. Utilizing Windows desktop management Application Programming Interfaces (APIs), the malware creates an invisible interactive workspace (HVNC):
The malware invokes CreateDesktopA or CreateDesktopW alongside SetThreadDesktop to instantiate a parallel desktop session detached from the primary user interface.
Hidden browser instances are launched within this isolated context, allowing the threat actor to navigate web sessions, manipulate active corporate Single Sign-On (SSO) sessions, and bypass multi-factor authentication triggers without displaying visual indicators to the victim.
The malware manages local execution persistence by establishing scheduled tasks or Registry Run keys, ensuring survivability across system restarts.
Enterprises managing extensive remote workforces and cloud accounts should continuously audit their public footprint. Using tools such as FemtoSec's Dark Web Scanner allows organizations to evaluate whether leaked credentials and employee credentials harvested by infostealers have appeared on underground markets.
The command and control (C2) framework implemented in Hermes provides bidirectional interaction between the compromised host and the threat actor's management panel. Operating over encrypted communication channels, the C2 server receives continuous telemetry and issues operational instructions.
Hermes provides the operator with comprehensive remote administration features, enabling post-exploitation activities without requiring secondary tool deployment:
Arbitrary Command Execution: Direct invocation of cmd.exe and powershell.exe to run system reconnaissance scripts, query Active Directory environments, and manipulate local security configurations.
Remote File System Management: Full access to download arbitrary secondary payloads, upload harvested credential archives, and delete local forensic artifacts.
Process and Task Management: Real-time enumeration of running processes, coupled with capabilities to terminate endpoint detection and response (EDR) processes or local antivirus services.
For organizations seeking continuous visibility across external assets and misconfigured endpoints susceptible to initial breach staging, an integrated attack surface management program is critical to preventing initial network infiltration.
Detecting Hermes requires a combination of behavioral analysis, API monitoring, and process anomaly detection. Because the malware attempts to operate covertly within parallel virtual desktop sessions, standard file-based signatures must be supplemented with runtime behavioral telemetry.
Security Operations Center (SOC) teams and threat hunters should implement specific detection rules focused on infostealer mechanics and HVNC behaviors:
Suspicious Desktop Creation: Alert on non-system processes calling CreateDesktop or SetThreadDesktop APIs, specifically when initiated by unsigned executables or binaries located in user-writable directories (e.g., %AppData%, %Temp%, %LocalAppData%).
Unauthorized Browser Profile Access: Monitor file system access where non-browser binaries attempt to read or copy SQLite files located in %LocalAppData%\Google\Chrome\User Data\Default\Network\Cookies or %AppData%\Mozilla\Firefox\Profiles\.
Hidden Command Line Spawning: Flag parent-child process anomalies where unknown binaries launch powershell.exe or cmd.exe with hidden window parameters such as -WindowStyle Hidden or /C flags directing output to temporary files.
When triaging potential Hermes infections, defenders should examine endpoint logs for unexpected outbound connections over non-standard ports, monitor for rapid bursts of clipboard queries, and inspect security event logs for unauthorized user privilege assertions.
Remediating an incident involving an advanced infostealer with HVNC capabilities demands a disciplined, multi-stage recovery strategy. Because session cookies and active tokens may have been exfiltrated during the intrusion, host-level cleanup alone is insufficient to prevent persistent unauthorized access.
Immediate containment prevents lateral movement and continuous data exfiltration:
Network Isolation: Disconnect the compromised endpoint from both wired and wireless networks immediately to sever active HVNC channels and C2 communication.
Process and Registry Remediation: Identify and terminate unauthorized parent processes. Inspect and purge malicious registry persistence entries within HKCU\Software\Microsoft\Windows\CurrentVersion\Run and related scheduled tasks.
Complete Endpoint Reimaging: In enterprise environments, reimage the infected workstation from a trusted, verified baseline image to guarantee complete removal of hidden components and persistence mechanisms.
Post-infection identity remediation is essential to block ongoing account abuse:
Global Session Revocation: Invalidate all active user sessions, refresh tokens, and OAuth authorizations across identity providers (IdPs), cloud platforms, and SaaS applications used on the endpoint.
Credential and MFA Reset: Enforce complete password resets for all corporate, personal, and administrative accounts accessed from the machine, and re-enroll Multi-Factor Authentication (MFA) devices.
Dark Web Reconnaissance: Engage dark web monitoring services to track whether exfiltrated credentials, browser tokens, or organizational data are circulating in underground forums or broker channels.
Organizations facing targeted malware campaigns or seeking to validate their detection engineering against advanced adversary tradecraft can contact FemtoSec for a free consultation.
