RFB, short for Remote Framebuffer, is the wire protocol used by VNC to send screen updates and control input between a client and a remote graphical session. In practical terms, it is what lets an operator see a device’s desktop and move the mouse or type as if sitting in front of it.
In cyber security, RFB matters because it can provide live remote control with very little user-visible friction. Defenders may use it for legitimate administration, but attackers can hide it inside malware to monitor a victim’s device, interact with apps, or bypass simple credential theft. On mobile fraudware, a concealed RFB/VNC channel can help criminals adapt in real time when an app asks for extra verification or shows anti-fraud prompts. Monitoring unexpected remote-access behavior, especially alongside overlay abuse or accessibility abuse, is a useful defense signal.