When malware on a phone silently changes the data a user copies, sends or stores, the damage lands somewhere else: a payment goes to the wrong wallet, or a business decision rests on altered records. MITRE ATT&CK for Mobile tracks this as T1641 Data Manipulation, an Impact technique in which adversaries insert, delete or alter data to manipulate external outcomes or hide activity, with one sub-technique, T1641.001 Transmitted Data Manipulation. This guide explains the clipboard swap pattern that dominates the real cases, the Android version changes that limit it, and how to detect and respond. It is for mobile security engineers, app developers in finance and crypto, and incident responders, and builds on the MITRE ATT&CK for Mobile Guide.
Key takeaways
- ATT&CK lists Android only. Both T1641 and T1641.001 have Android as their only platform in ATT&CK v20; there is no iOS procedure example.
- The clipboard is the main real world target. ATT&CK's examples (Android/Clipper.C, S.O.V.A., BRATA) all inject or replace clipboard contents, typically cryptocurrency addresses.
- Android 10 changed the economics. On Android 10 and higher an app cannot access clipboard data unless it is the default input method editor (IME) or the app that currently has focus.
- Apps must verify what matters. Payment and wallet apps should show the full destination for confirmation and never trust pasted values alone.
- Detection leans on app vetting. ATT&CK's detection strategy looks for clipboard listeners and cross-app writes from packages that have no business doing them.
How the technique works
ATT&CK describes T1641 broadly: altering data to affect a business process, organisational understanding or decision making. For complex systems it notes an adversary would usually need special expertise gained through a long information gathering campaign. On mobile the documented cases are much narrower.
T1641.001 Transmitted Data Manipulation
The sub-technique covers altering data en route to storage or other systems, over a network connection or between processes. ATT&CK's main mobile example is the device clipboard: a malicious app watches for clipboard changes through the ClipboardManager.OnPrimaryClipChangedListener interface and replaces text before it is pasted, for example swapping a copied Bitcoin wallet address for one the attacker controls. ATT&CK notes that, before Android 10, listening to, reading and modifying the clipboard needed no explicit permission and could run in the background.
| Software (ATT&CK ID) | Behaviour as ATT&CK records it | Source cited by ATT&CK |
|---|---|---|
| Android/Clipper.C | Replaced copied cryptocurrency wallet addresses; distributed through Google Play | ESET |
| BRATA (S1094) | Injected string contents into the device clipboard | McAfee |
| S.O.V.A. (S1062) | Manipulated clipboard data to replace cryptocurrency addresses | ThreatFabric |
Case detail: ESET reported in February 2019 that Android/Clipper.C posed as MetaMask, an Ethereum service that had no official mobile app at the time, aimed to steal credentials and private keys, and could swap copied Bitcoin or Ethereum addresses for the attacker's. It appeared on Google Play around 1 February 2019 and Google removed it after ESET's report.
Reading the clipboard without changing it is a separate collection technique, T1414 Clipboard Data. Network interception that alters traffic sits under Adversary-in-the-Middle (T1638). This page covers only the manipulation.
Platform controls: Android and iOS
| Control | Android | iOS and iPadOS |
|---|---|---|
| Clipboard access by background apps | From Android 10, only the default IME or the focused app can access clipboard data (ATT&CK mitigation M1006 Use Recent OS Version) | ATT&CK records no T1641 procedure for iOS |
| App vetting | Google Play Protect checks apps at install and periodically scans, and may deactivate or remove harmful apps, including apps from other sources | App Store distribution; MDM app inventory for managed devices |
| Hardening for high-risk users | Managed profile with app allow list | Lockdown Mode limits message attachments, links and complex web technologies |
The residual Android risk after Android 10 comes from two places: devices still on older versions, and malicious apps that become the default keyboard or abuse accessibility to act while in the foreground. Treat any request to become the default IME or an accessibility service as high risk. See the Mobile App Permissions.
Prevention controls
- Enforce an OS floor: block corporate access from Android versions below 10 through MDM compliance, since ATT&CK's mitigation rests on the Android 10 clipboard change.
- Restrict keyboards and accessibility: on managed Android, allow list input methods and accessibility services so an unknown app cannot become the IME.
- Block sideloading and keep Play Protect on: Clipper.C reached users through an official store, so add app vetting for anything outside the approved list.
- Design apps to resist swaps: wallet, banking and payment apps should display the full destination on a confirmation screen, check addresses against an address book or checksum, and avoid placing secrets such as seed phrases or keys on the clipboard at all. See the Mobile Banking App Security Guide.
- Protect integrity end to end: sign or authenticate transaction data server side so a value changed on the device fails verification (NIST SP 800-53 SC-8, SI-7).
- Coach users: teach users to compare the first and last characters of any pasted address before sending funds.
Detection and measurement
ATT&CK's detection strategies DET0683 (Transmitted Data Manipulation) and DET0660 (Data Manipulation) both rely on app vetting traces plus EMM inventory, on Android only.
| Evidence | Source | Alert logic |
|---|---|---|
| ClipboardManager.addOnPrimaryClipChangedListener registered | Dynamic analysis during app vetting | Listener in an app with no clipboard related feature |
| ContentResolver.update or file writes to another app's data | Dynamic analysis, forensic acquisition | Writer not in the list of legitimate IPC partners |
| Managed package inventory | Android Enterprise EMM | New or unapproved keyboard, accessibility service or unknown package |
| Transaction anomalies | Backend fraud monitoring | Payment destinations that differ from the user's history after a paste |
Metrics: share of Android fleet on version 10 or later; count of unapproved IMEs or accessibility services per month; percentage of new apps dynamically vetted; number of transactions held for destination mismatch; time from user report to device isolation.
Response
- Stop further transactions from the affected account and contact the payment provider or exchange quickly.
- Isolate the device from corporate resources and revoke its sessions and app tokens.
- Capture the installed app list and any MTD alerts before removal; use the Mobile Forensics Guide for acquisition.
- Remove the app, rotate credentials and keys that were on the device, and restore from a known good state.
- Check backend logs for other altered records from the same device or account.
Common failure patterns
- Trusting the official store as proof of safety: Clipper.C was distributed through Google Play before removal.
- Ignoring legacy Android: the clipboard protection only applies from Android 10.
- Unrestricted keyboards: letting users install any IME hands an app the one role that still reads the clipboard in the background.
- Pasted values with no confirmation: apps that send funds straight from a pasted field give a swap no chance of being noticed.
- Integrity only on the device: without server side verification, altered data is accepted as genuine.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| ATT&CK for Mobile | T1641, T1641.001; M1006 (the only mitigation ATT&CK v20 maps); DET0660, DET0683 | Technique, mitigation, detection |
| NIST SP 800-53 Rev 5 | SC-8 Transmission Confidentiality and Integrity; SI-7 Software, Firmware, and Information Integrity; CM-11 User-installed Software; AC-19 Access Control for Mobile Devices | Integrity of data in transit and control of apps |
| NIST CSF 2.0 | PR.PS-05; DE.CM-09 | Prevent unauthorised software, monitor devices |
The enterprise equivalent is T1565 Data Manipulation.
Practitioner checklist
- Block Android versions below 10 from corporate resources.
- Allow list keyboards and accessibility services on managed devices.
- Vet new apps dynamically for clipboard listeners and cross-app writes.
- Require full destination confirmation in payment and wallet apps.
- Verify transaction integrity on the server, not just the device.
- Monitor for destination changes against user history.
- Brief users who move funds on checking pasted addresses.
Standards and references
- MITRE ATT&CK: T1641 Data Manipulation (Mobile)
- MITRE ATT&CK: T1641.001 Transmitted Data Manipulation
- Android Developers: Privacy changes in Android 10
- Google Play Help: Use Google Play Protect
- Apple Support: About Lockdown Mode
- ESET WeLiveSecurity: First clipper malware discovered on Google Play
Related NHI Mgmt Group resources: MITRE ATT&CK for Mobile Guide · Mobile Malware Guide · Mobile App Security Guide · Android Enterprise Security Guide