What attackers do. Attackers collect data from the clipboard as users copy and paste, capturing passwords, cryptocurrency addresses or sensitive text, and sometimes replacing clipboard content. This serves the Collection tactic.
How to defend. Use endpoint protection that detects infostealer and clipboard hijacking malware, and encourage password managers that clear the clipboard after use. Limit clipboard sharing in remote sessions for sensitive environments. Train users handling payments or cryptocurrency to check pasted addresses carefully before confirming. Application control helps stop the malware that performs clipboard theft from running at all.
Signs to look for. Look for unfamiliar processes repeatedly accessing clipboard APIs, and transactions where a pasted destination address differs from the one copied. A common gap is that clipboard access is rarely logged, so detection relies on identifying the malware itself.