A couple months ago I turned VNC on quickly, without a password, just to test out an app that turns my iPad into a trackpad for my computer. Of course, forgot

A couple months ago I turned VNC on quickly, without a password, just to test out an app that turns my iPad into a trackpad for my computer. Of course, forgot to turn off VNC after learning the iPad trackpad wasn't a great solution for me. A couple days later as I was working, my cursor kept getting pulled away from me and I figured there must be some tracking issue with the mouse, not giving it a second thought. I started reading something at my desk and looked up - a tab had been opened in Chrome to some .ru domain name and someone was clicking a 'Pay with PayPal' link on the page. With my PayPal password auto-filled, they would have had easy work of getting into my account to pay a large, arbitrary amount to themselves. Luckily, I caught it just in time. They were so good at keeping control of the mouse that I had to run to unplug my router. Point is, VNC is a really easy vector to gain access to a computer and there are apparently people or bot constantly port scanning everything to find what's unsecured. Was definitely a wake up call for me and I wouldn't be surprised if this is a similar case.