HVNC hidden desktop creation correlated with inherited browser session or anomalous parent

Duo Tech@duotech

•updated Aug 14, 2026•0•0•2

Detects creation of a non-default hidden desktop by a browser process, correlated with either an inherited long-lived authenticated browser network session or a non-standard parent process, consistent with OnyxC2's HVNC capability.