Monitoring and preventing remote user automated cyber attacks

A method, comprising:

• at a computing platform comprising at least one processor, a communication interface, and memory:
• detecting, by the at least one processor, new activity data on a virtual desktop accessed by a remote computing device;
• evaluating, by the at least one processor, the new activity data relative to data associated with a series of activities authorized by the remote computing device accessing the virtual desktop, wherein evaluating includes applying a machine learning model to the new activity data to identify a change in a type of content accessed or a change in access type at the virtual desktop;
• determining, by the at least one processor, if the new activity data is indicative of a potential cyber-attack based on evaluating the new activity data relative to the data associated with the series of activities;
• and
• in response to determining that the new activity data is indicative of the potential cyber-attack, initiating, by the at least one processor, one or more security response actions,
• wherein initiating the one or more security response actions includes transmitting a security response alert to a data loss prevention computing device, and wherein transmitting the security response alert causes a screen mirroring session of the remote computing device to initiate at a display of the data loss prevention computing device.

One or more non-transitory computer-readable media storing instructions that, when executed by a computing platform comprising at least one processor, a communication interface, and memory, cause the computing platform to:

• detect new activity data from a remote user account at a remote computing device, wherein detecting the new activity data includes detecting an idle state at the remote computing device prior to detecting the new activity data and after receiving data associated with a series of activities authorized by the remote computing device accessing a virtual desktop;
• evaluate the new activity data relative to data associated with the series of activities authorized by the remote computing device accessing the remote user account to identify a change in content access categorization;
• determine if the new activity data is indicative of a potential cyber-attack based on evaluating the new activity data relative to the series of activities and based on identifying the change in the content access categorization;
• and
• in response to determining that the new activity data is indicative of the potential cyber-attack, initiate one or more security response actions.