The malware can switch to a signalling mode that allows attackers to manually scroll and tap through a live stream of the virtual screen.