Virtual coupling of automated trains has emerged as a promising technology to enhance the operational efficiency and line capacity of railway transportation systems. However, the vulnerability of such systems to malicious cyber attacks poses a significant threat to their stability, reliability and applicability. This article addresses the challenge of ensuring secure virtual coupling control of connected train platoons subject to various cyber attacks, including false data injection attacks, denial-of-service attacks, and replay attacks. First, based on the low-dimensional and noisy sensor measurements, novel set-valued observers are designed for each follower train to estimate their inaccessible full longitudinal motion states despite uncertainties and unknown attacks and noises. Then, distributed secure attack-compensation-based virtual coupling control laws are developed to ensure the platoon's stability and resilience against cyber attacks. Additionally, formal stability analysis of the resultant estimation error system and platoon tracking error system is provided. Furthermore, two algorithms are presented to elaborate the offline observer and controller design process as well as their online implementation. Finally, based on the data of a realistic urban rail transit line, simulation experiments are conducted to validate the efficacy of the proposed theoretical findings.