[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:mitre-attack\u002Ft1115":3},{"item":4,"lessons":18,"controls":44,"related":72},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"mitre-attack","t1115","T1115","Clipboard Data",6,"MITRE","**What attackers do.** Attackers collect data from the clipboard as users copy and paste, capturing passwords, cryptocurrency addresses or sensitive text, and sometimes replacing clipboard content. This serves the Collection tactic.\n\n**How to defend.** Use endpoint protection that detects infostealer and clipboard hijacking malware, and encourage password managers that clear the clipboard after use. Limit clipboard sharing in remote sessions for sensitive environments. Train users handling payments or cryptocurrency to check pasted addresses carefully before confirming. Application control helps stop the malware that performs clipboard theft from running at all.\n\n**Signs to look for.** Look for unfamiliar processes repeatedly accessing clipboard APIs, and transactions where a pasted destination address differs from the one copied. A common gap is that clipboard access is rarely logged, so detection relies on identifying the malware itself.","Adversaries may collect data stored in the clipboard from users copying information within or between applications. \n\nFor example, on Windows adversaries can access clipboard data by using `clip.exe` or `Get-Clipboard`. Additionally, adversaries may monitor then replace users’ clipboard with their data (e.g., Transmitted Data Manipulation).\n\nmacOS and Linux also have commands, such as `pbpaste`, to grab clipboard contents.","© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).","https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1115\u002F","Open the technique on MITRE ATT&CK",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40],{"slug":21,"title":22,"published_at":23},"powershell-backdoor-taskstomp-exfiltrates-sensitive-data-via-phishing","PowerShell Backdoor TASK#STOMP Exfiltrates Sensitive Data via Phishing","2026-09-21T16:21:38.292+00:00",{"slug":25,"title":26,"published_at":27},"sality-botnet-dismantled-after-20-years-of-global-malicious-activity","Sality Botnet Dismantled After 20 Years of Global Malicious Activity","2026-09-02T10:22:18.213+00:00",{"slug":29,"title":30,"published_at":31},"fake-free-vpn-extensions-weaponized-via-staged-malicious-updates","Fake Free VPN Extensions Weaponized via Staged Malicious Updates","2026-06-30T00:20:23.016+00:00",{"slug":33,"title":34,"published_at":35},"fake-github-stars-and-virustotal-reviews-used-to-legitimize-crypto-stealing-malware","Fake GitHub Stars and VirusTotal Reviews Used to Legitimize Crypto-Stealing Malware","2026-06-22T14:21:45.814+00:00",{"slug":37,"title":38,"published_at":39},"cryptobandits-malware-uses-tor-to-hide-backdoor-and-steal-crypto-funds","CryptoBandits Malware Uses Tor to Hide Backdoor and Steal Crypto Funds","2026-06-19T12:20:21.798+00:00",{"slug":41,"title":42,"published_at":43},"usb-lnk-worm-deploys-crypto-clipper-via-tor-based-c2","USB LNK Worm Deploys Crypto Clipper via Tor-Based C2","2026-06-18T16:20:41.907+00:00",[45,49,54,58,63,67],{"slug":46,"name":47,"problem":48,"stories":9},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":50,"name":51,"problem":52,"stories":53},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",3,{"slug":55,"name":56,"problem":57,"stories":53},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",{"slug":59,"name":60,"problem":61,"stories":62},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",2,{"slug":64,"name":65,"problem":66,"stories":62},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",{"slug":68,"name":69,"problem":70,"stories":71},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",1,[73,79,84,90,95,99,103,107],{"family":74,"item":75,"code":76,"title":77,"together":78},"nist-800-53","si-3","SI-3","Malicious Code Protection",5,{"family":80,"item":81,"code":82,"title":83,"together":78},"cis","13","Control 13","Network Monitoring and Defense",{"family":85,"item":86,"code":87,"title":88,"together":89},"nist-csf","de-cm","DE.CM-1","Continuous Monitoring",4,{"family":91,"item":92,"code":93,"title":94,"together":53},"gdpr","32","Article 32","Security of processing",{"family":80,"item":96,"code":97,"title":98,"together":53},"2","Control 2","Inventory and Control of Software Assets",{"family":74,"item":100,"code":101,"title":102,"together":53},"au-12","AU-12","Audit Record Generation",{"family":80,"item":104,"code":105,"title":106,"together":62},"14","Control 14","Security Awareness and Skills Training",{"family":80,"item":108,"code":109,"title":110,"together":62},"4","Control 4","Secure Configuration of Enterprise Assets and Software"]