magnification-api-screenshot

Abuse of the Windows Magnification API (Magnification.dll) to capture the desktop or specific window regions at high quality with programmatic control over scaling, filtering, and excluded windows. The Magnification API is less commonly monitored than BitBlt or PrintWindow, providing a stealthier screen-capture channel.

Technique Details

• Initialization: MagInitialize, MagSetWindowSource define the capture rectangle ^[strings.txt]
• Scaling control: MagImageScaling, MagSetImageScalingCallback adjust quality and size of captured bitmaps ^[strings.txt]
• Window filtering: MagSetWindowFilterList excludes specific windows from the capture (e.g., the malware's own overlay) ^[strings.txt]
• Fallback: CaptureScreenExcluding falls back to GDI BitBlt if Magnification API is unavailable ^[strings.txt]

Cross-References

• sky-jamaica — family using this technique