Hidden VNC, often shortened to HVNC, is a remote-control technique that lets an operator view and use a device without obvious visual signs on the victim’s screen. Unlike ordinary remote desktop tools, the attacker may interact with a separate or hidden session, so the user sees little or nothing while the operator clicks, types, and navigates.
This matters because it turns a compromised phone or computer into a live fraud terminal. In mobile malware, hidden VNC can be paired with accessibility abuse and overlays to open banking apps, approve actions, or bypass user awareness in real time. Defenders look for unusual remote-session activity, accessibility permissions granted to untrusted apps, and screen behavior that does not match user input. Blocking suspicious permissions and monitoring for invisible interaction paths can reduce the risk.