A new technique where attackers leverage forgotten artifacts from Remote Desktop Protocol (RDP) sessions to reconstruct sensitive information long after connections have ended.

The technique exploits the RDP bitmap cache, a performance optimization feature that stores screen elements locally as small tiles. While designed to enhance connection speed by caching static elements rather than repeatedly transmitting them, these cached tiles persist after sessions end, creating an unintentional record of remote activities