Hidden Window is a MITRE ATT&CK technique, T1564.003, in which malicious activity is placed in a window or desktop context that is not normally visible to the user. On Windows, attackers can create or switch to a separate desktop so a browser, remote-control tool, or other GUI process keeps running out of sight. This is not the same as minimizing a window; the activity is still active, just concealed from the user’s current view.
This matters because many defenses and users rely on visible prompts, taskbar icons, or foreground windows to notice suspicious behavior. Hidden windows can support credential theft, fraud, or covert operator access while looking harmless on screen. Defenders should monitor desktop creation and switching, unusual GUI processes launched from non-interactive parents, and sessions that use browsers or system tools outside normal workflows. Visibility on the screen is not proof of safety; the important signal is what the machine is doing behind the scenes.