A technique where malware or a malicious process replaces clipboard contents with different data, often to redirect copied addresses, commands, or payment details. It works by monitoring the clipboard and swapping text or other data before the user pastes it, which can enable fraud or command injection.
What clipboard replacement is used for
Clipboard replacement is usually a post-compromise or user-targeted technique: malware watches for copied text, then substitutes attacker-controlled content just before paste. That makes it effective against copied payment details, addresses, commands, or other sensitive values because the user often trusts what they already copied.
The technique matters because the clipboard is a transient trust boundary, not a protected input channel. If a user copies a wallet address, shell command, or ticketing token, the replacement can redirect funds, alter system behaviour, or quietly change the meaning of a pasted value without breaking the user’s workflow.
How clipboard replacement works
Most implementations rely on clipboard monitoring rather than deep exploitation of the application itself. A malicious process can subscribe to clipboard changes, compare the copied content against patterns it expects, and swap in a different string or payload before the next paste action.
The replacement can be broad or highly targeted. Some malware swaps anything that resembles a cryptocurrency address, while other variants focus on commands, email addresses, or payment fields. That targeting reduces noise and increases the chance that the pasted value will still look plausible to the user or receiving system.
Because the clipboard is shared across many applications, the technique is also attractive for cross-application abuse. A value copied in one trusted context can be altered and pasted into a browser, terminal, chat client, or payment form, which lets the attacker move the impact into a different execution or transaction path.
Why clipboard replacement is dangerous
The danger comes from deception at the point of use. The victim often believes they are pasting an authentic value they just copied, so the attack bypasses normal visual checks and can succeed without phishing a fresh credential or forcing a malicious download at that moment.
Where the pasted content is a command, the impact can be operational rather than just financial. A modified shell command, script line, or admin instruction can change the target, introduce an attacker-controlled endpoint, or silently add an argument that shifts the effect of the command.
For copied secrets or session material, clipboard replacement can also create secondary exposure if the attacker substitutes a lookalike token or destination that causes the user to disclose sensitive data to the wrong place. The clipboard is not the secret itself, but it can be the delivery path for something equally sensitive.
Detection and defensive controls
Defence works best by reducing the value of the clipboard as a trust channel. Good endpoint telemetry can help identify processes that read or write the clipboard unusually often, especially when that behaviour is paired with browser activity, terminal use, or repeated pattern-matching against payment and address formats.
User verification still matters, but it should be paired with technical controls that reduce silent replacement opportunities. For example, organisations can harden endpoints, restrict untrusted software, and use security tooling that flags suspicious clipboard manipulation and related persistence on managed devices.
For broader endpoint and control alignment, defenders can map clipboard abuse to established monitoring and hardening practices in NIST SP 800-53 Rev 5 Security and Privacy Controls and use the detection and response lens in MITRE ATT&CK Enterprise Matrix to reason about malicious process behaviour, execution chains, and post-compromise activity.
Practical examples and operational impact
In practice, clipboard replacement most often shows up in fraud and intrusion scenarios where the attacker benefits from a tiny but reliable manipulation point. A pasted payment address that is only slightly different can still look legitimate to the person sending funds, and a pasted command can still look syntactically correct if the attacker preserves the overall structure.
The operational impact is usually highest when users copy values they do not re-verify after pasting. That makes the technique especially effective in finance, cryptocurrency transfer workflows, administrative scripting, and any environment where copy and paste is treated as routine rather than as a security-sensitive action.
Because the method is simple, stealthy, and cheap to automate, it remains a durable endpoint abuse pattern rather than a one-off trick. Treating clipboard contents as potentially mutable is the right mental model, especially when the pasted value has direct financial, administrative, or authentication consequences.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | Clipboard tampering is detectable through endpoint audit and anomaly review. |
| SI-4 — System Monitoring | Clipboard replacement is a malicious process behaviour that monitoring can surface. | |
| Recommendation — Review endpoint activity for suspicious clipboard access and substitution patterns. Monitor managed endpoints for unauthorized clipboard hooks and repeated content swapping. | ||
| MITRE ATT&CK | T1115 — Clipboard Data | This technique directly abuses clipboard data to replace copied content. |
| Recommendation — Map observed clipboard substitution activity to T1115 and hunt for related malware behaviour. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Clipboard abuse is best investigated with centralized logging and alerting on suspicious endpoint behaviour. |
| Recommendation — Centralize endpoint logs and alert on suspicious clipboard-related process activity. | ||
Related resources from NHI Mgmt Group
- What happens when clipboard replacement malware reaches a developer workstation through a malicious browser extension?
- When should organisations prioritise PAM replacement over more tuning?
- What is the difference between VPN replacement and session governance?
- What breaks when Zero Trust is treated as MFA plus VPN replacement?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 3, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org