HVNC Hidden Desktop Creation via CreateDesktopW and Off-Screen explorer.exe Launch

Duo Tech@duotech

•updated Jul 23, 2026•1•0•2

Detects creation of a hidden Windows desktop (via CreateDesktopW/SetThreadDesktop) followed by launching explorer.exe onto that desktop with CREATE_NEW_CONSOLE, a pattern used by HVNC (Hidden VNC) modules to run a covert, off-screen shell for remote control and screenshot streaming.