Screenshot capture is the repeated recording of what is visible on a user’s screen. Malware may take screenshots at a fixed interval, such as every few hundred milliseconds, to build a near real-time feed of the victim’s activity. Unlike a one-time screenshot, this creates a stream of visual context that can reveal chats, documents, browser sessions, game overlays, and authentication prompts.
In cyber attacks, screenshot capture is often paired with keylogging, clipboard theft, or remote access trojans to increase the attacker’s visibility into the system. It matters because it can expose sensitive information even when data is protected at rest, and it can help attackers monitor a victim’s behavior without needing full file access. Defenders look for unusual screenshot loops, excessive image creation, and outbound transfers of image data, especially inside suspicious installers or remote-control tools. Blocking untrusted software and monitoring endpoint behavior are key ways to reduce the risk.