Hidden-VNC is a stealthy remote-control technique that lets an operator interact with a graphical desktop or application session without obvious screen mirroring. Instead of showing a visible remote desktop window, the attacker may control a hidden session, a background display, or a cloned GUI instance. The result is interactive access that looks normal to the local user.
In cyber attacks, Hidden-VNC-style behavior is useful for quietly driving browsers, opening files, or approving prompts while the victim keeps working. It can also help malware reuse an already logged-in browser profile or other authenticated session. Defenders look for unusual GUI automation, unexpected remote-control processes, duplicate browser launches, nonstandard display access, and profile activity that does not match the user’s visible screen.