Clipboard Hijacking

How clipboard hijacking works

Clipboard hijacking is a content-substitution attack: the victim copies something legitimate, but malware, injected script, or a malicious browser component silently swaps the clipboard payload before paste. The user sees normal copy-and-paste behaviour, which makes the attack deceptive and hard to spot.

The technique is simple, but the abuse case depends on what gets replaced. A single altered paste can redirect a crypto payment, change a command, or swap a credential or token into an attacker-controlled destination. That makes the attack useful both for direct theft and for setting up a second-stage compromise.

Why clipboard hijacking is dangerous

The danger comes from trust in the paste action itself. People often verify the on-screen source, not the hidden clipboard value, so the attack bypasses visual caution and exploits routine behaviour. In practice, the attacker only needs one successful paste at the right moment.

Where credentials or commands are targeted, clipboard hijacking can become a stepping stone to broader compromise. Reused secrets, copied shell commands, and pasted admin values can expose systems, redirect workflows, or create unintended execution paths if the replacement is not noticed.

For payment and wallet scenarios, the impact is immediate: the recipient address changes and the funds go to the attacker. For command substitution, the risk is execution of an attacker-chosen instruction that may install malware, disable protections, or fetch additional payloads.

Common attack paths and delivery methods

Clipboard hijacking is usually delivered through a malicious endpoint process, a browser extension, injected JavaScript, or a lure that encourages copy-and-paste behaviour. The attacker needs a way to observe clipboard activity, match patterns such as wallet addresses or commands, and replace the copied value quickly enough to survive user scrutiny.

Because the attack can happen in the browser or on the host, defenders should think in layers. Browser-based interception can affect web users during normal transactions, while endpoint malware can alter clipboard contents across applications, including terminals, office tools, chat clients, and password managers.

In many cases, clipboard hijacking is paired with social engineering. The victim is nudged to paste into a payment form, a terminal, or a support workflow, which gives the attacker a convenient moment to substitute the payload.

Detection, containment, and user protection

Detection should focus on the environment that can modify the clipboard, not just on the final paste event. Endpoint telemetry, browser extension review, script auditing, and suspicious process monitoring are all relevant when clipboard content changes unexpectedly or when users report strange pasted values.

Hardening should reduce the chances of clipboard tampering in the first place. That usually means limiting untrusted browser extensions, controlling script injection, tightening endpoint execution paths, and using safer workflows for sensitive values such as wallet addresses, administrative commands, and secrets.

Users should be trained to verify critical pasted content character by character, especially for one-time payments and privileged commands. In parallel, organisations can reduce exposure by using copyless workflows where possible, shortening the time sensitive data lives in the clipboard, and preferring controlled transfer methods for secrets.

Risk and Threat Considerations

Clipboard hijacking is especially dangerous because it turns a trusted user action into a covert substitution point. The attacker does not need to defeat authentication directly if they can redirect a payment, alter a command, or capture a secret at the moment it is pasted.

Failure mechanism: Malware, injected scripts, or a malicious extension monitors clipboard events and replaces the intended value with an attacker-chosen string before paste, defeating user expectation and basic visual review.

Impact: The outcome can include stolen funds, malware execution, credential exposure, or unauthorised access to systems and accounts when a substituted value is accepted as legitimate.

Practitioner Guidance

What to watch for: Treat clipboard hijacking as a control problem as much as a malware problem. If users regularly paste payment details, commands, or secrets, the organisation should assume the clipboard is a sensitive trust boundary and monitor the software that can modify it.

Governance implication: Control ownership should sit with endpoint security, browser governance, and user awareness together, because no single team can see every clipboard path. Where high-value transfers or administrative commands are common, define safer approved workflows so copying and pasting are not the default control.

Related resources from NHI Mgmt Group

• How should security teams reduce the risk of clipboard hijacking malware in online payment workflows?
• How should security teams respond when typosquatted open source packages are used to deliver clipboard hijacking malware?
• How can security teams detect clipboard hijacking on endpoints?
• How can security teams reduce the risk of session hijacking in SaaS environments?