You’re sitting at your desk.
Working. Maybe on a spreadsheet. Maybe answering emails. Your screen looks normal. Your machine is running fine. Nothing feels off.
And on the exact same machine, at the exact same moment, an attacker is logged into your internal systems, browsing your files, and staging their next move.
Not on a separate connection. Not through a shared screen. On a completely invisible desktop running silently underneath yours — one you will never see, never feel, and never know existed.
That’s not a hypothetical. That’s STX RAT.
A RAT That Gives Attackers a Parallel Existence
STX RAT is a remote access trojan — but calling it that undersells what it actually does.
Most RATs give an attacker a foothold.
STX RAT gives them a parallel existence.
It was first observed in late February 2026 inside a financial sector organization, delivered through a browser download. Within weeks, a second campaign appeared using trojanized FileZilla installers. Same payload. Different entry point. Multiple operations running almost immediately after discovery.
That speed matters.
The researchers at eSentire named it after a technical signature in its communication — every message to its command-and-control server begins with the STX byte, the “Start of Text” character. Small detail, but it tells you exactly what this is.
This wasn’t thrown together.
This was engineered.
The Delivery Chain
The initial infection is layered by design.
A VBScript file is dropped through a browser download or a compromised installer. That script launches JScript with elevated privileges. The JScript retrieves a TAR archive, passes execution into a PowerShell loader, and the final payload is injected directly into memory.
No file written to disk. No obvious artifact left behind.
Different entry points — browser delivery or trojanized FileZilla installers — but the same chain every time.
Once execution begins, STX RAT immediately shifts into defense.
It checks for VirtualBox, VMware, and QEMU environments — the exact environments analysts rely on to study malware. If it detects one, it performs what researchers call a jitter exit: a randomized delay followed by clean termination.
No behavior. No useful logs. Nothing to analyze.
Then it moves deeper.
It patches a core Windows RPC function to disable AMSI, effectively blinding security tools that rely on it for in-memory scanning. It removes its own terminal window from Alt+Tab and the taskbar.
By the time it finishes initialization, it has already made itself invisible — both to automated tools and to the user sitting at the machine.
The Introduction Message
Before doing anything else, STX RAT introduces itself.
It sends the attacker a full profile of the system:
Hostname. Username. OS version. Privilege level. Installed antivirus products. System memory.
Everything needed to understand the environment before interacting with it.
That communication is encrypted using X25519 key exchange and ChaCha20-Poly1305 — modern cryptographic standards used in secure messaging systems.
From the outside, it doesn’t look malicious.
It looks like legitimate encrypted traffic.
What It Steals
The infostealer module targets credentials from tools like FileZilla, WinSCP, and Cyberduck — tools commonly used by developers, sysadmins, and IT teams.
It also captures a screenshot of the active desktop and sends it along with the harvested data.
That alone would be enough to cause damage.
But that’s not what makes this different.
The Invisible Desktop
Hidden Virtual Network Computing — HVNC — is where this changes.
STX RAT creates a completely separate desktop session that only the attacker can see.
Not a mirrored screen. Not a remote view.
A second, independent desktop running in the background.
While you work in your visible session, the attacker operates in theirs.
They open browsers. Log into internal platforms. Access file systems. Move laterally. Launch applications. Interact with your environment exactly the way you do.
Keystrokes. Mouse input. Navigation.
Full control.
And none of it appears on your screen.
There is no cursor movement. No windows opening. No indication that anything else is happening.
Your system behaves normally — because it is running normally.
It’s just running two realities at the same time.
A Pattern Worth Paying Attention To
A few issues ago I covered ZeroDayRAT — commercial spyware being sold on Telegram for two thousand dollars, giving buyers full access to a target’s phone.
This follows the exact same pattern.
Capabilities that used to require advanced resources are being packaged, refined, and deployed faster than organizations can adapt.
HVNC was not widely seen in commodity malware a year ago.
Now it’s appearing in targeted enterprise campaigns with polished delivery chains, encrypted communication, and anti-analysis techniques built in from the start.
This isn’t experimentation.
This is operational.
What Makes This Different
Every security control we rely on assumes something will look wrong.
The user will notice something. The system will behave differently. There will be a signal.
A slowdown. A flicker. A warning.
Something.
HVNC removes that assumption entirely.
There is nothing to notice.
The attacker is not disrupting your session.
They are operating alongside it.
The Shift
Not louder attacks. Not faster attacks.
Quieter ones.
More controlled.
More deliberate.
Attacks that don’t need to hide — because there’s nothing visible to hide from.
The Reality
You don’t get a warning.
No ransomware screen. No system failure. No alert telling you something is wrong.
You keep working.
And so do they.
Same machine. Same credentials. Same access.