Hidden VNC, or HVNC, is a covert remote desktop technique that lets an operator control a Windows system without showing an active desktop to the logged-in user. Instead of attaching to the visible session, the attacker creates or uses a hidden session that can receive mouse and keyboard input in the background.
HVNC matters because it turns malware from a simple data thief into a hands-on intrusion tool. An operator can browse, launch programs, steal browser sessions, move files, or perform fraud while the victim sees no obvious remote-control window. In real attacks, HVNC is often paired with remote-access trojans and session hijacking to keep access after initial compromise. Defenders should watch for unusual remote GUI activity, unexpected hidden sessions, suspicious VNC-related processes, and outbound connections from endpoints that do not match normal user behavior.