The input desktop is the active Windows desktop that receives keyboard and mouse input. Windows can host multiple desktops in one session, but only one desktop is the current input target at a time. Windows UI objects, including windows and processes attached to them, can exist on a different desktop from the one the user sees.
This matters in security because malware can create or switch to a hidden desktop to keep operator activity out of view while still using normal applications, such as a browser, inside the same session. That can support stealthy remote control, credential abuse, or fraud without obvious pop-ups on the visible screen. Defenders should monitor desktop creation and switching, unusual GUI processes, and parent-child process chains that do not match normal user behavior. A process on a hidden desktop may still be fully active even though it is not visible to the user.