My coworker's computer was logged into via RDP by an unknown person. He took pictures of what was open on the desktop before being disconnected when the other person logged back in.
The hacker was in the process of purchasing a VPN and a domain with a (probably stolen?) credit card.
Why were they purchasing these things via RDP? So it can't easily be traced back to them? Or were they going to connect the computer via VPN to a botnet or something?