System Screenshot Detection

View product v1.3.0

Some types of applications handle sensitive information (for example, banking or financial apps). When the app goes to the background, iOS creates a system snapshot that is later shown in the App Switcher and in some cases on the lock screen. This snapshot may contain sensitive data.

Malwarelytics for Apple can detect the moment when this snapshot is created and optionally cover the UI with an overlay before it happens.

This feature is available only on Apple platforms (iOS). It requires Malwarelytics for Apple SDK 3.3.0+.

Configuration

This feature can be configured during the Malwarelytics initialization in MalwarelyticsConfig.

import { MalwarelyticsConfig } from "react-native-malwarelytics";

const config: MalwarelyticsConfig = {
  apple: {
    rasp: {
      systemScreenshot: {
        action: 'HIDE',             // or 'NOTIFY' or 'NO_ACTION'
        trigger: 'RESIGN_ACTIVE',   // or 'BACKGROUND' (default)
        overlay: {
          type: 'BLUR'              // or 'DEFAULT', 'COLOR', 'IMAGE'
        }
      }
    }
  }
}

Available Actions

Value	Description
`'NO_ACTION'`	System screenshot is not handled automatically. No delegate calls are triggered.
`'NOTIFY'`	Detection is enabled and the listener is notified via `systemScreenshotDetected()`. The SDK does not change the UI. This is the default action.
`'HIDE'`	Detection is enabled, the listener is notified via `systemScreenshotDetected()`, and the SDK covers the app UI with the configured overlay.

Trigger Configuration

The trigger determines when the detection fires:

Value	Description
`'RESIGN_ACTIVE'`	Triggered when the app resigns active state (`UIApplication.willResignActiveNotification`). Recommended when you want to protect the App Switcher snapshot.
`'BACKGROUND'`	Triggered when the app enters background (`UIApplication.didEnterBackgroundNotification`). Useful when the app should be covered while running in background. The system snapshot may already be taken at this point. This is the default value.

Overlay Configuration

When the action is 'HIDE', you can configure the overlay that covers the app content. The overlay configuration uses the same MalwarelyticsAppleOverlay type as screen capture detection:

Value	Description
`'DEFAULT'`	Covers the screen with a solid color and the application icon.
`'COLOR'`	Covers the screen with a solid color. Requires the `color` property.
`'IMAGE'`	Covers the screen with an image. Requires the `image` property.
`'BLUR'`	Covers the screen with a strong system blur over a snapshot of the current app content.

The native SDK also supports custom UIView overlays (.view), but this is not available through the React Native wrapper.

Example with a color overlay:

systemScreenshot: {
    action: 'HIDE',
    trigger: 'RESIGN_ACTIVE',
    overlay: {
        type: 'COLOR',
        color: {
            red: 0,
            green: 0,
            blue: 0,
            alpha: 255
        }
    }
}

Usage

Registering an Observer

To receive notifications about system screenshot events, implement the optional systemScreenshotDetected method in your MalwarelyticsRaspListener.

import { Malwarelytics, MalwarelyticsRaspListener } from "react-native-malwarelytics";

const listener: MalwarelyticsRaspListener = {
    // ... other listener methods
    systemScreenshotDetected(): void {
        console.log("System screenshot detected (App Switcher snapshot)");
        // React according to the application's own security policy
    }
}

Malwarelytics.sharedInstance.rasp.setRaspListener(listener);

Note: If the action is 'HIDE', the overlay is applied automatically by the SDK in addition to notifying the listener. If the action is 'NOTIFY', only the listener callback is delivered — no overlay is applied.

Last updated on May 21, 2026 (10:02) View product