Clipboard poisoning is an attack where malicious content is copied into a user’s clipboard so it is pasted into the wrong place. It often targets copied cryptocurrency addresses, commands, or credentials, and relies on the clipboard being reused without the user noticing the substitution.
How Clipboard Poisoning Works
Clipboard poisoning is not a break-in at the application layer, it is an interference attack on a user’s copy-and-paste workflow. Malware, a malicious browser extension, or another local compromise can watch for copied text and replace it before paste time, turning a familiar user action into a silent substitution.
The technique is effective because the clipboard is usually treated as temporary, low-friction plumbing. That makes it a useful delivery point for attackers who want to change a destination address, alter a command, or swap in a different secret without triggering obvious warnings.
Why the Attack Is So Effective
Clipboard poisoning succeeds when the copied value is difficult to verify visually or when the user expects repeated copying and pasting. Cryptocurrency addresses are a classic target because they are long and error-prone, but commands, file paths, URLs, and credential material can be manipulated in the same way.
It is especially dangerous in workflows where the pasted content has immediate side effects. A single substituted command can execute with the current user’s privileges, and a single altered address can transfer funds or data to an attacker-controlled destination.
Security Implications for Users and Organisations
For individuals, the direct consequence is usually theft, misdirection, or command execution using trusted user context. For organisations, the broader issue is that clipboard substitution can bypass careful review habits because the visible action still appears to be a normal paste operation.
This is why basic perimeter thinking is insufficient. If a workstation is already compromised, the clipboard becomes part of the attacker’s post-compromise path, and the user may become the final confirmation step for malicious content. NIST SP 800-53 Rev 5 Security and Privacy Controls is a useful reference point for the broader control themes involved, including integrity, access control, and monitoring. NIST SP 800-53 Rev 5 Security and Privacy Controls
Detection and Prevention Patterns
Defence is strongest when organisations reduce the chance that a hostile process can observe or rewrite clipboard data, and when users can more easily verify what they are pasting. Endpoint protection, least-privilege workstation design, browser hardening, and scrutiny of suspicious extensions all help reduce exposure.
For command-line and administrative work, the safer pattern is to avoid pasting unverified commands from untrusted sources and to prefer typed or templated operations where possible. For address-based workflows, users should verify the full destination through an independent channel rather than trusting the clipboard alone. MITRE ATT&CK Enterprise Matrix helps defenders map the surrounding attacker behaviour, including credential access and post-compromise activity that often accompanies this kind of abuse. MITRE ATT&CK Enterprise Matrix
Risk and Threat Considerations
Clipboard poisoning is risky because it turns a routine usability feature into a trust boundary problem. Once the clipboard is influenced by malware or a malicious extension, the attacker can silently redirect transactions, alter administrative commands, or substitute sensitive values before the user notices.
Failure mechanism: The attacker gains write access to clipboard contents and swaps a trusted payload for a visually similar one, relying on the user to paste without re-validating the result.
Impact: The result can be financial loss, command execution, credential exposure, or unintended data transfer, often with little evidence until after the action has already succeeded.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | SI-7 — Software, Firmware, and Information Integrity | Clipboard poisoning undermines content integrity on the endpoint. |
| AC-6 — Least Privilege | Limits what a compromised user session can do after pasted commands run. | |
| Recommendation — Apply SI-7 to detect and block unauthorized content substitution on managed endpoints. Enforce AC-6 to reduce the damage from maliciously altered pasted commands. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Logging helps investigate suspicious endpoint and paste-related abuse. |
| Recommendation — Centralize endpoint and browser logs to support detection of clipboard tampering. | ||
Practitioner Guidance
What to watch for: Treat repeated clipboard tampering, unexpected paste results, or browser-extension drift as a workstation integrity issue, not just a user mistake. The practical question is whether the endpoint can still be trusted to preserve user intent between copy and paste.
Practitioner takeaway: The right control mindset is to verify the endpoint first, because clipboard poisoning is usually the symptom of a broader local compromise rather than a standalone defect.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 3, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org