What Is Clipboard Scraping? Definition & Examples

Clipboard scraping is malware or code that reads text copied to the clipboard. It is used to steal passwords, cryptocurrency addresses, one-time codes, or other sensitive data before the user pastes it. The technique relies on clipboard access at the endpoint or browser level, and defenders look for abnormal clipboard monitoring or replacement.

Clipboard Monitoring and Data Theft

Clipboard scraping is dangerous because the clipboard often carries the exact value a user is about to paste, which may include passwords, one-time codes, wallet addresses, or other secrets. Malware that can observe or replace clipboard contents turns a convenience feature into a high-value data theft path.

The technique is especially effective when the stolen value is short-lived or time-sensitive, because the user may not notice that the text changed before pasting it. In practice, the attack depends on endpoint or browser-level access to the clipboard channel, so it often sits alongside other post-compromise abuse rather than appearing as a standalone exploit.

Where Clipboard Scraping Happens

Clipboard scraping can occur in desktop malware, malicious browser extensions, injected scripts, remote-access tooling, or other code running with enough access to read clipboard events. The exact implementation varies, but the security problem is the same: untrusted code is able to inspect or alter content that users assume is transient and private.

This makes the clipboard a cross-application trust boundary. A value copied from a password manager, chat app, terminal, admin console, or crypto wallet may briefly exist in a form that is easy for malware to harvest before it ever reaches its intended destination.

Why the Technique Works

Clipboard scraping succeeds because many users copy sensitive material as part of normal work, often outside the protection of application-specific controls. That means the attacker does not need to break the source system directly if they can intercept the handoff step between copy and paste.

It is also useful for credential theft and fraud because the attacker can substitute a lookalike value, such as swapping one cryptocurrency address for another. In those cases, the compromise is not only disclosure but also silent redirection of a transaction or authentication flow.

Detection and Defensive Control Points

Defenders should treat abnormal clipboard access as a signal worth investigating, especially when it coincides with browser compromise, suspicious extensions, remote execution, or other malware behaviour. Useful telemetry includes endpoint monitoring for clipboard polling, unexpected process access to GUI or browser components, and repeated replacement of copied content.

Controls that reduce exposure include limiting arbitrary code execution, hardening browsers and endpoints, reviewing extension trust, and reducing how often highly sensitive material is copied into the clipboard in the first place. Threat detection also benefits from correlating clipboard activity with credential theft, wallet tampering, or post-exploitation behaviour described in MITRE ATT&CK Enterprise Matrix. Endpoint hardening and access control guidance in NIST SP 800-53 Rev 5 Security and Privacy Controls and baseline hardening practices in CIS Benchmarks are directly relevant here.

Risk and Threat Considerations

Clipboard scraping creates a high-leverage theft path because it targets data at the moment it is most usable to an attacker and least visible to a user. The same technique can expose credentials, session-related codes, payment details, or wallet addresses, which makes the impact disproportionate to the small amount of code needed to harvest it.

Failure mechanism: Malware or malicious code gains clipboard visibility, then polls, reads, or replaces copied text before paste time. In some cases the attacker only needs brief endpoint access or a malicious browser context to capture high-value material.

Impact: The result can be credential compromise, transaction redirection, one-time-code theft, or silent data leakage across any application that relies on copy-and-paste workflows.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
MITRE ATT&CK	T1115 — Clipboard Data	Defines clipboard scraping as a credential and data access technique.
Recommendation — Map clipboard-harvesting activity to T1115 and hunt for processes that read or modify copied data.
NIST SP 800-53 Rev 5	SI-4 — System Monitoring	Supports detection of abnormal clipboard access and malware-like endpoint behaviour.
	AC-6 — Least Privilege	Limits the ability of code and users to access sensitive endpoint data unnecessarily.
Recommendation — Instrument SI-4 monitoring for suspicious clipboard polling and replacement activity. Apply AC-6 to reduce the processes and users that can interact with sensitive clipboard-adjacent data.
CIS Controls v8	CIS-4 — Secure Configuration of Enterprise Assets and Software	Hardening endpoints and browsers reduces the attack surface used by clipboard malware.
Recommendation — Harden endpoints and browsers to shrink the malware surface that enables clipboard scraping.

Practitioner Guidance

What to watch for: Prioritise investigation when users report paste failures, changed destination values, or unexpected clipboard behaviour after copying sensitive data. Those symptoms can indicate replacement malware rather than ordinary user error.

Governance implication: Treat clipboard use as a data-handling risk, not just a usability detail. Where possible, steer users toward methods that avoid copying highly sensitive values, and require stronger endpoint assurance for devices that handle secrets, admin access, or payment-related workflows.

Clipboard Scraping