HVNC stands for hidden virtual network computing. It is a remote-control technique that lets an operator interact with a victim’s desktop in a way that is less visible to the local user than a normal remote desktop session. The screen may appear idle or ordinary while the attacker clicks, types, and navigates in the background.
In cyber security, HVNC matters because it helps malware operators stay interactive without drawing attention. It is often paired with credential theft, browser session hijacking, or proxying so the attacker can log in, move through accounts, or test access while avoiding obvious signs. Defenders should watch for unexpected remote-control processes, hidden windows, unusual input activity, and network connections that do not match legitimate admin tools. HVNC is valuable to attackers because it reduces user awareness, but it is also detectable through endpoint telemetry, session monitoring, and behavioral alerts.