Screenshots wouldn't be of much help. The frequency would need to be almost like a low-fps video recording in order to capture the buttons' pressed state. At that is assuming the state is visually distinct in the first place.
The usual way a keylogger like this would work is taking a screenshot on every mouse click (and maybe every few keystrokes), with the mouse pointer location recorded alongside (if not visible in the screenshot). It is a lot more difficult than just recording keystrokes though.
Wouldn't you just need to screenshot on any mouse click/return key event?
Some keyloggers do printscreens on mouse presses, bypassing this issue.
Not if it’s a physical keylogger, which I think was the primary concern.
there are indeed keyloggers that do this, but it wasn't common in the early 2000s when most of these on-screen keyboard setups were implemented.
My intuition tells me that nowadays, if you can embed an arbitrary program "keylogger" onto a computer, it should also log most user events, not just "keyboard events", including screenshots of areas around mouse clicks, maybe a small OCR module etc.
Of course, a physical keylogger is a different beast, but really, if you got physical access enough to install an actual piece of hardware...
screenshots take up a LOT more data than text. seems unlikely unless you have an advanced script kiddie specifically targetting you.