Collect Data from Clipboard is the reading of text or objects stored in a user’s clipboard. Attackers use clipboard access to steal passwords, session tokens, cryptocurrency addresses, or copied commands, and to replace pasted content. Defenders should limit clipboard access, especially in sensitive applications, and monitor for unusual clipboard scraping.
How clipboard collection works
Clipboard collection is a short-lived but high-value form of data capture. The clipboard often holds whatever a user has just copied, which means a successful read can expose sensitive text before it is pasted anywhere else.
The key security issue is context loss. A clipboard read does not need to understand whether the item is a password, token, address, or command, only that it is available in memory or through an application interface. That makes clipboard access attractive for opportunistic theft and for harvesting data that users assume is temporary.
Why clipboard data is attractive to attackers
Attackers target clipboard contents because copied material is often immediately useful. Passwords, session tokens, API keys, wallet addresses, and administrator commands can all be exposed in a single read, especially when the clipboard is reused across applications or devices.
Clipboard theft also supports substitution attacks. A malicious process can wait for a copied cryptocurrency address or command, then replace it before paste time, turning a routine user action into fraud, misdirection, or system compromise. The same pattern is discussed in Data Exfiltration Guide, which covers clipboard data among broader exfiltration paths.
Where exposure usually comes from
Exposure depends on which applications can read the clipboard and how often users copy sensitive material. Browser extensions, desktop utilities, remote-management tools, malicious scripts, and compromised software can all become collection points when clipboard permissions are broad or poorly understood.
Organisations should also treat sensitive applications differently from ordinary productivity tools. If an application handles credentials, transaction details, or privileged commands, clipboard access becomes part of the trust boundary around that application, not just a convenience feature.
For practical control design, clipboard access sits alongside broader access-control and monitoring concerns in NIST SP 800-53 Rev 5 Security and Privacy Controls, which includes controls for access control, audit, and system integrity.
Monitoring, prevention, and safe handling
Defence starts with reducing where sensitive data is copied, then limiting which apps can observe or alter clipboard contents. Monitoring should look for abnormal clipboard scraping patterns, repeated reads, and unexpected clipboard changes after a user copies high-risk data.
When clipboard use cannot be avoided, organisations should prefer safer workflows such as masked values, one-time secrets, constrained paste behaviour, or application-specific transfer mechanisms. The goal is not to ban copy and paste everywhere, but to keep sensitive data from becoming ambiently available to untrusted software.
For identity and access programs, clipboard collection is also a reminder that secret handling is an operational control problem, not just a user-behaviour problem. Guidance on secret exposure and lifecycle hardening is well aligned with the OWASP Non-Human Identities Top 10, especially where copied tokens, keys, or automation credentials are involved.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8, NIST CSF 2.0, NIST SP 800-53 Rev 5 and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1056.001 — Keylogging | Clipboard scraping is a data capture technique used for credential and token theft |
| Recommendation — Map clipboard-scraping telemetry to collection techniques and hunt for adjacent credential theft activity. | ||
| CIS Controls v8 | CIS-6 — Access Control Management | Clipboard access should be limited where sensitive data is handled |
| Recommendation — Restrict clipboard-capable applications and remove unnecessary data handling access paths. | ||
| NIST CSF 2.0 | PR.AA-05 — Least Privilege | Clipboard reads become a trust-boundary issue when apps can access sensitive content |
| Recommendation — Limit application access to clipboard functions to the minimum required for business use. | ||
| NIST SP 800-53 Rev 5 | AU-2 — Event Logging | Clipboard scraping is best detected through auditable application and endpoint events |
| Recommendation — Log clipboard-related access and correlate unusual read patterns with sensitive user activity. | ||
| OWASP ASVS | V14 — Data Protection | Copy-and-paste of secrets is a data-protection concern for sensitive applications |
| Recommendation — Design sensitive flows to minimise exposed secret material in the clipboard. | ||