Hermes Stealer Emerges with HVNC and Token Theft

Hermes Stealer Capabilities and Behavior

The operational capabilities and behavior of Hermes extend well beyond conventional infostealers. While legacy stealers focus solely on collecting static flat files and browser databases for offline decryption, Hermes incorporates interactive surveillance and remote management capabilities designed to subvert user awareness and operational controls.

Targeted Data and Browser Extraction

Hermes systematically targets identity and credential repositories stored across client endpoints. The software actively scrapes data from multiple browser architectures:

• Chromium-Based Browsers: Targets Google Chrome, Microsoft Edge, Brave, Opera, and related variants to extract encrypted SQLite databases containing autofill details, saved credentials, Web Data, and active session cookies.

• Gecko-Based Browsers: Scans Mozilla Firefox and derivative profiles, extracting key4.db, logins.json, and master password-protected key stores.

• Cryptocurrency Wallets: Directly extracts data from more than 100 browser extension wallets, cold wallet configuration files, and local cryptocurrency management software.

• Session Tokens and Communications: Collects active session tokens and local databases from communication and gaming platforms, including Discord, Telegram, and Steam.

Real-Time Surveillance and Input Logging

Beyond static credential dumping, the malware exhibits dynamic behavior through real-time host monitoring. Keylogging routines intercept global keystrokes across user sessions, while clipboard monitoring intercepts sensitive data such as temporary passwords and wallet addresses during copy-paste operations. In addition, the malware incorporates GPU-accelerated screen capture routines to stream active desktop sessions directly to the operator console with low latency.

Infection Chain and Persistence Mechanisms

The infection chain for malware distributed under a Malware-as-a-Service (MaaS) model typically relies on diverse distribution pipelines controlled by individual threat actors. Initial execution vectors for Hermes commonly leverage malicious spam attachments, SEO poisoning leading to trojanized software installers, malvertising lures, and malicious archive distribution.

Execution and Hidden Desktop Spawning

Once initial execution is achieved on the target operating system, Hermes initiates defense evasion routines by establishing an isolated virtual desktop. Utilizing Windows desktop management Application Programming Interfaces (APIs), the malware creates an invisible interactive workspace (HVNC):

• The malware invokes CreateDesktopA or CreateDesktopW alongside SetThreadDesktop to instantiate a parallel desktop session detached from the primary user interface.

• Hidden browser instances are launched within this isolated context, allowing the threat actor to navigate web sessions, manipulate active corporate Single Sign-On (SSO) sessions, and bypass multi-factor authentication triggers without displaying visual indicators to the victim.

• The malware manages local execution persistence by establishing scheduled tasks or Registry Run keys, ensuring survivability across system restarts.

Enterprises managing extensive remote workforces and cloud accounts should continuously audit their public footprint. Using tools such as FemtoSec's Dark Web Scanner allows organizations to evaluate whether leaked credentials and employee credentials harvested by infostealers have appeared on underground markets.

Command and Control Infrastructure

The command and control (C2) framework implemented in Hermes provides bidirectional interaction between the compromised host and the threat actor's management panel. Operating over encrypted communication channels, the C2 server receives continuous telemetry and issues operational instructions.

Interactive Host Management

Hermes provides the operator with comprehensive remote administration features, enabling post-exploitation activities without requiring secondary tool deployment:

• Arbitrary Command Execution: Direct invocation of cmd.exe and powershell.exe to run system reconnaissance scripts, query Active Directory environments, and manipulate local security configurations.

• Remote File System Management: Full access to download arbitrary secondary payloads, upload harvested credential archives, and delete local forensic artifacts.

• Process and Task Management: Real-time enumeration of running processes, coupled with capabilities to terminate endpoint detection and response (EDR) processes or local antivirus services.

For organizations seeking continuous visibility across external assets and misconfigured endpoints susceptible to initial breach staging, an integrated attack surface management program is critical to preventing initial network infiltration.

Detection Logic and Indicators of Compromise

Detecting Hermes requires a combination of behavioral analysis, API monitoring, and process anomaly detection. Because the malware attempts to operate covertly within parallel virtual desktop sessions, standard file-based signatures must be supplemented with runtime behavioral telemetry.

Behavioral Detection Logic

Security Operations Center (SOC) teams and threat hunters should implement specific detection rules focused on infostealer mechanics and HVNC behaviors:

• Suspicious Desktop Creation: Alert on non-system processes calling CreateDesktop or SetThreadDesktop APIs, specifically when initiated by unsigned executables or binaries located in user-writable directories (e.g., %AppData%, %Temp%, %LocalAppData%).

• Unauthorized Browser Profile Access: Monitor file system access where non-browser binaries attempt to read or copy SQLite files located in %LocalAppData%\Google\Chrome\User Data\Default\Network\Cookies or %AppData%\Mozilla\Firefox\Profiles\.

• Hidden Command Line Spawning: Flag parent-child process anomalies where unknown binaries launch powershell.exe or cmd.exe with hidden window parameters such as -WindowStyle Hidden or /C flags directing output to temporary files.

Investigative Indicators

When triaging potential Hermes infections, defenders should examine endpoint logs for unexpected outbound connections over non-standard ports, monitor for rapid bursts of clipboard queries, and inspect security event logs for unauthorized user privilege assertions.

Removal and Recovery Procedures

Remediating an incident involving an advanced infostealer with HVNC capabilities demands a disciplined, multi-stage recovery strategy. Because session cookies and active tokens may have been exfiltrated during the intrusion, host-level cleanup alone is insufficient to prevent persistent unauthorized access.

Host Containment and Eradication

Immediate containment prevents lateral movement and continuous data exfiltration:

• Network Isolation: Disconnect the compromised endpoint from both wired and wireless networks immediately to sever active HVNC channels and C2 communication.

• Process and Registry Remediation: Identify and terminate unauthorized parent processes. Inspect and purge malicious registry persistence entries within HKCU\Software\Microsoft\Windows\CurrentVersion\Run and related scheduled tasks.

• Complete Endpoint Reimaging: In enterprise environments, reimage the infected workstation from a trusted, verified baseline image to guarantee complete removal of hidden components and persistence mechanisms.

Identity and Session Recovery

Post-infection identity remediation is essential to block ongoing account abuse:

• Global Session Revocation: Invalidate all active user sessions, refresh tokens, and OAuth authorizations across identity providers (IdPs), cloud platforms, and SaaS applications used on the endpoint.

• Credential and MFA Reset: Enforce complete password resets for all corporate, personal, and administrative accounts accessed from the machine, and re-enroll Multi-Factor Authentication (MFA) devices.

• Dark Web Reconnaissance: Engage dark web monitoring services to track whether exfiltrated credentials, browser tokens, or organizational data are circulating in underground forums or broker channels.

Organizations facing targeted malware campaigns or seeking to validate their detection engineering against advanced adversary tradecraft can contact FemtoSec for a free consultation.