Screen streaming is a malware capability that sends live or near-live images of a victim’s desktop to a remote operator. Instead of collecting a single screenshot, the malware continuously captures the screen and transmits updates so the attacker can watch activity as it happens.
This matters because it gives an intruder interactive visibility into the host. An operator can observe logins, files, prompts, and security tools in real time, which helps with manual espionage, fraud, and follow-up actions that are harder to automate. Defenders may see unusual outbound traffic, repeated image-like transmissions, or remote access tooling that pairs screen capture with keyboard and mouse control. In practice, screen streaming is often found in remote access trojans and other hands-on intrusion tools, where it supports stealthy surveillance and reduces the need for constant command execution.