Passwords, one-time codes, recovery phrases and API keys pass through the phone clipboard every day, and a malicious app that reads it collects them without breaking any encryption. MITRE ATT&CK for Mobile T1414 Clipboard Data describes adversaries abusing clipboard manager APIs to obtain sensitive information copied on the device, and places it under both Collection (TA0035) and Credential Access (TA0031) for Android and iOS. This guide covers how each platform now restricts clipboard reads, what the ATT&CK procedure examples show, how to detect clipboard harvesting with app vetting, MDM and network data, and which settings reduce the exposure. It is for mobile security engineers, MDM administrators and app developers. For the wider Mobile matrix, see the MITRE ATT&CK for Mobile Guide.
Key takeaways
- The clipboard is a credential path. ATT&CK's own example is a password copied from a password manager being captured by a malicious app, which is why T1414 sits under Credential Access as well as Collection.
- Both platforms have narrowed access. Since Android 10 only the app in focus or the default input method editor (IME) can read clipboard data; since iOS 14 the system notifies the user when an app reads pasteboard content from another app without user intent.
- Old OS versions remove the guardrails. ATT&CK's only listed mitigation is M1006 Use Recent OS Version, so OS currency is the first control.
- Developers control what lands on the clipboard. Android's
EXTRA_IS_SENSITIVEflag and iOS pasteboard options (localOnly,expirationDate) limit exposure of copied secrets. - Detection is indirect. You will rarely see the read itself in production; ATT&CK's detection strategy relies on app vetting traces, managed app inventory and network flows.
What T1414 covers on Android and iOS
ATT&CK describes the technique on both platforms, with the platform behaviour taken from vendor documentation:
| Aspect | Android | iOS and iPadOS |
|---|---|---|
| API named by ATT&CK | ClipboardManager.OnPrimaryClipChangedListener() to monitor changes; getPrimaryClip() to read | UIPasteboard.general.string on the systemwide general pasteboard |
| Background access | Android 10 and later: only the app that has focus or the default IME can access clipboard data | Reading is possible, but iOS 14 and later notifies the user when an app gets general pasteboard content from another app without user intent |
| User-visible signal | Android 12 and later usually shows a toast "APP pasted from your clipboard" when an app calls getPrimaryClip(); it shows only the first time for repeated reads from the same source | A system notice that the app pasted from the source app, for example Messages |
| Ways to inspect without reading | getPrimaryClipDescription() returns metadata without the toast | hasStrings, hasURLs, types and pattern detection methods avoid the notice |
| Developer protections for copied secrets | ClipDescription.EXTRA_IS_SENSITIVE hides the content from the Android 13 copy preview; Google says all apps must set it for passwords and card data | localOnly keeps the item off Universal Clipboard (Handoff) and expirationDate removes it at a set time |
| Enterprise control | Work profile separation and allow-listed IMEs (see Input Capture) | "Managed pasteboard" restriction (iOS 15, no supervision needed) controls pasting from apps under Open In management |
Two exceptions matter. A malicious keyboard registered as the default IME keeps clipboard access on Android, which links this technique to its sibling, Mobile T1417 Input Capture. And a trojanised app the user opens in the foreground can still read the clipboard legitimately, which is how many of the ATT&CK procedure examples operate.
Real cases from ATT&CK procedure examples
ATT&CK v20 lists five software entries for T1414, each backed by vendor reporting:
- RatMilad (S1241): Android spyware that collected clipboard content, reported by Zimperium in 2022.
- BOULDSPY (S1079): Android surveillance tool that can collect clipboard data, reported by Lookout in 2023.
- GolfSpy (S0421): Android spyware that can obtain clipboard contents, reported by Trend Micro (Bouncing Golf).
- RCSAndroid (S0295): commercial surveillance implant that can monitor clipboard content, reported by Trend Micro.
- XcodeGhost (S0297): iOS apps built with a tampered Xcode that could read and write the user's clipboard, reported by Palo Alto Networks.
The pattern is consistent: clipboard theft is one module in a broader spyware or trojan toolkit, not a standalone attack. XcodeGhost is also a supply chain lesson: the apps were legitimate products compiled with a compromised toolchain. For spyware response, see the Mobile Spyware Infection Response Playbook.
Where identity fits
The clipboard often carries machine credentials as well as human ones. Engineers copy API keys, personal access tokens and cloud console secrets between a password manager and a mobile app or browser; support staff copy one-time codes. Each copied value is briefly readable by whichever app holds focus or the keyboard. Treat this as a reason to keep long-lived secrets off phones where possible, prefer passkeys and autofill (which do not use the clipboard) over copy and paste, and rotate any secret found on a device you are investigating. See Securing the password manager (enterprise) itself.
Prevention and hardening
| Control | Android | iOS and iPadOS | Owner |
|---|---|---|---|
| OS currency (ATT&CK M1006) | Block enrolment or access below Android 10; prefer 12 or later for the access toast | Block access below iOS 14; current release preferred | MDM team |
| Keyboard control | Allow-list input methods through the device policy controller | Review third-party keyboards in managed app inventory | MDM team |
| Data boundary | Keep corporate apps in the work profile | Enable "Managed pasteboard" and block managed documents in unmanaged destinations | MDM team |
| Copy hygiene in your own apps | Set EXTRA_IS_SENSITIVE on copied passwords, tokens and card data | Use localOnly and a short expirationDate when copying secrets | App developers |
| Avoid copy and paste of secrets | Use Autofill and passkeys | Use AutoFill and passkeys | IAM team |
| App source control | Block unknown sources on managed devices; Google Play Protect on | Restrict installs to the App Store or managed distribution | MDM team |
OWASP MASVS covers the developer side in MASVS-STORAGE (preventing unintended leakage of sensitive data) and MASVS-PLATFORM (secure display and handling of sensitive data). Test that password and token fields in your own apps either block copy or mark the clip sensitive.
Implementation steps
- Measure first. Pull OS versions from MDM and list devices below Android 10 or iOS 14, the points where background clipboard reads became restricted or visible.
- Set a compliance floor. Use conditional access to block corporate apps on devices below your floor; start in report-only mode, then enforce with a grace period.
- Turn on data boundaries. Enable iOS "Managed pasteboard" and the managed/unmanaged document restrictions for a pilot group; on Android confirm corporate apps live in the work profile. Collect user feedback for a fortnight, since these restrictions break some legitimate paste workflows.
- Fix your own apps. Add
EXTRA_IS_SENSITIVEand iOS pasteboard options to any feature that copies a secret, and add a MASVS test case. - Vet third-party apps. In dynamic analysis, flag apps that register clipboard listeners or read the pasteboard at launch without user action.
- Roll back safely. Each restriction is a profile or policy setting: keep the previous profile version so you can revert a group within minutes if a business app breaks.
Detection and measurement
ATT&CK's detection strategy for T1414 (Detection of Clipboard Data) correlates three sources per platform:
| Data source | Android signal | iOS signal |
|---|---|---|
| App vetting or instrumented dynamic analysis | Runtime trace of ClipboardManager.addOnPrimaryClipChangedListener() | Runtime trace of UIPasteboard.general.string access |
| Management state | Managed package inventory and metadata from Android Enterprise or EMM | Managed app telemetry or ManagedApplicationFeedback through Apple MDM |
| Network | Android Enterprise network logging (DnsEvent, ConnectEvent) or VPN flow metadata | Network Extension filter, per-app VPN or secure web gateway flows |
Android network logging is available to a device owner from Android 8 and to a work profile owner from Android 12, records DNS lookups and TCP connections, and does not see apps that make direct system calls, so pair it with gateway data. Useful measures:
- OS floor compliance: percentage of managed devices at or above Android 10 / iOS 14 (target 100%).
- Vetting coverage: percentage of approved third-party apps run through dynamic analysis that records clipboard API use.
- Sensitive copy coverage: number of in-house app features that copy secrets without the sensitive flag or expiry (target zero).
- Restriction coverage: percentage of iOS devices with "Managed pasteboard" enabled.
- User reports: count of users reporting unexpected "pasted from" notices, triaged within one working day.
Common failure patterns
- Training users to ignore the notice. The iOS and Android paste notices are useful only if users report unexpected ones; tell them what one looks like.
- Leaving legacy devices on the network. Devices below Android 10 allow background clipboard listeners, which removes the main platform control.
- Copy buttons for secrets. In-house apps that offer "copy token" without a sensitive flag or expiry place long-lived keys where any focused app can read them.
- Trusting the toolchain. XcodeGhost shows that a legitimate app built with a tampered SDK can carry clipboard code; verify developer tooling and SDK sources.
- Ignoring keyboards. A third-party default IME has clipboard access on Android, so keyboard allow-listing is part of this control set.
Framework mapping
| Framework | Reference | How it applies |
|---|---|---|
| MITRE ATT&CK for Mobile | T1414; tactics TA0035, TA0031; mitigation M1006 | Technique, tactics and the single listed mitigation |
| NIST SP 800-53 Rev 5 | AC-19 Access Control for Mobile Devices; CM-11 User-installed Software; SI-4 System Monitoring | Mobile configuration, app installation control, monitoring |
| NIST CSF 2.0 | PR.PS-02; DE.CM-09 | Keep software current; monitor endpoints and runtime environments |
| OWASP MASVS | MASVS-STORAGE, MASVS-PLATFORM | Developer controls on data leakage and sensitive UI data |
Practitioner checklist
- Set and enforce an OS floor of Android 10 and iOS 14 or later for corporate access.
- Enable iOS "Managed pasteboard" and managed/unmanaged document restrictions.
- Keep corporate apps inside the Android work profile.
- Allow-list keyboards on managed Android devices and review third-party keyboards on iOS.
- Mark copied secrets sensitive on Android and set
localOnlyand expiry on iOS in your own apps. - Push passkeys and autofill so users stop copying passwords and codes.
- Include clipboard API use in dynamic app vetting.
- Rotate API keys and tokens found on any device under investigation.
Standards and references
- MITRE ATT&CK: Clipboard Data, Mobile T1414
- MITRE ATT&CK: Use Recent OS Version, M1006
- Android Developers: Privacy changes in Android 10
- Android Developers: Copy and paste
- Apple Developer: UIPasteboard
- Apple Platform Deployment: Restrictions for iPhone and iPad
- Android Developers: Network activity logging
- OWASP: Mobile Application Security Verification Standard
Related NHI Mgmt Group resources: MITRE ATT&CK for Mobile Guide · Mobile Device Management Security Guide · iOS and iPadOS Enterprise Security Guide · Android Enterprise Security Guide · Mobile Spyware Infection Response Playbook · Mobile T1417 Input Capture · Mobile T1634 Credentials from Password Store