A virtual (on-screen) keyboard requires the user to click characters with a mouse instead of typing, which defeats software keyloggers that record physical keystrokes. It offers no particular protection against phishing, pharming, or session hijacking, since those attacks don't rely on capturing keystrokes.