1. Home
  2. Techniques
  3. Enterprise
  4. Clipboard Data

Clipboard Data

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

For example, on Windows adversaries can access clipboard data by using clip.exe or Get-Clipboard.[1][2][3] Additionally, adversaries may monitor then replace users’ clipboard with their data (e.g., Transmitted Data Manipulation).[4]

macOS and Linux also have commands, such as pbpaste, to grab clipboard contents.[5]

ID: T1115
Sub-techniques:  No sub-techniques
ⓘ
Tactic: Collection
ⓘ
Platforms: Linux, Windows, macOS
Version: 1.2
Created: 31 May 2017
Last Modified: 24 October 2025
Version Permalink

Procedure Examples

ID Name Description
S0331 Agent Tesla

Agent Tesla can steal data from the victim’s clipboard.[6][7][8][9]
G0082 APT38

APT38 used a Trojan called KEYLIME to collect data from the clipboard.[10]
G0087 APT39

APT39 has used tools capable of stealing contents of the clipboard.[11]
S0373 Astaroth

Astaroth collects information from the clipboard by using the OpenClipboard() and GetClipboardData() libraries. [12]
S0438 Attor

Attor has a plugin that collects data stored in the Windows clipboard by using the OpenClipboard and GetClipboardData APIs.[13]
S1226 BOOKWORM

BOOKWORM has used its KBLogger.dll module to steal data saved to the clipboard. [14]
S0454 Cadelspy

Cadelspy has the ability to steal data from the clipboard.[15]
S0261 Catchamas

Catchamas steals data stored in the clipboard.[16]
S1149 CHIMNEYSWEEP

CHIMNEYSWEEP can capture content from the clipboard.[17]
S0660 Clambling

Clambling has the ability to capture and store clipboard data.[18][19]
S0050 CosmicDuke

CosmicDuke copies and exfiltrates the clipboard contents every 30 seconds.[20]
S0334 DarkComet

DarkComet can steal data from the clipboard.[21]
S1111 DarkGate

DarkGate starts a thread on execution that captures clipboard data and logs it to a predefined log file.[22][23]
S1066 DarkTortilla

DarkTortilla can download a clipboard information stealer module.[24]
S0363 Empire

Empire can harvest clipboard data on both Windows and macOS systems.[25]
S0569 Explosive

Explosive has a function to use the OpenClipboard wrapper.[26]

S0381 FlawedAmmyy

FlawedAmmyy can collect clipboard data.[27]
S0531 Grandoreiro

Grandoreiro can capture clipboard data from a compromised host.[28]
S0170 Helminth

The executable version of Helminth has a module to log clipboard contents.[29]
S1245 InvisibleFerret

InvisibleFerret has stolen data from the clipboard using the Python project "pyperclip".[30][31][32] InvisibleFerret has also captured clipboard contents during copy and paste operations.[33]
S0044 JHUHUGIT

A JHUHUGIT variant accesses a screenshot saved in the clipboard and converts it to a JPG image.[34]
S0283 jRAT

jRAT can capture clipboard data.[35]
S0250 Koadic

Koadic can retrieve the current content of the user clipboard.[36]
S0356 KONNI

KONNI had a feature to steal data from the clipboard.[37]
S0409 Machete

Machete hijacks the clipboard data by creating an overlapped window that listens to keyboard events.[38][39]

S0282 MacSpy

MacSpy can steal clipboard contents.[40]
S0652 MarkiRAT

MarkiRAT can capture clipboard content.[41]
S0530 Melcoz

Melcoz can monitor content saved to the clipboard.[42]
S0455 Metamorfo

Metamorfo has a function to hijack data from the clipboard by monitoring the contents of the clipboard and replacing the cryptocurrency wallet with the attacker's.[43][44]
S1146 MgBot

MgBot can capture clipboard data.[45][46]
S1122 Mispadu

Mispadu has the ability to capture and replace Bitcoin wallet data in the clipboard on a compromised host.[47]
G0049 OilRig

OilRig has used infostealer tools to copy clipboard data.[48]
C0014 Operation Wocao

During Operation Wocao, threat actors collected clipboard data in plaintext.[49]
S1233 PAKLOG

PAKLOG has monitored and extracted clipboard contents.[50]
S0332 Remcos

Remcos steals and modifies data from the clipboard.[51]
S0375 Remexi

Remexi collects text from the clipboard.[52]
S0240 ROKRAT

ROKRAT can extract clipboard data from a compromised host.[53]
S0148 RTM

RTM collects data from the clipboard.[54][55]
S0253 RunningRAT

RunningRAT contains code to open and copy data from the clipboard.[56]
S0692 SILENTTRINITY

SILENTTRINITY can monitor Clipboard text and can use System.Windows.Forms.Clipboard.GetText() to collect data from the clipboard.[57]

S0467 TajMahal

TajMahal has the ability to steal data from the clipboard of an infected host.[58]
S0004 TinyZBot

TinyZBot contains functionality to collect information from the clipboard.[59]
S0257 VERMIN

VERMIN collects data stored in the clipboard.[60]
S1207 XLoader

XLoader can collect data stored in the victim's clipboard.[61][62]
S0330 Zeus Panda

Zeus Panda can hook GetClipboardData function to watch for clipboard pastes to collect.[63]

Mitigations

This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.

Detection Strategy

ID Name Analytic ID Analytic Description
DET0341 Clipboard Data Access with Anomalous Context AN0965

Detection of clipboard access via OS utilities (e.g., clip.exe, Get-Clipboard) by non-interactive or abnormal parent processes, potentially chained with staging or exfiltration commands.
AN0966

Detection of pbpaste/pbcopy clipboard access by processes without terminal sessions or linked to launch agents, potentially staged for collection.
AN0967

Detection of xclip or xsel access to clipboard buffers outside of user terminal context, especially when chained to staging (gzip, base64) or network exfiltration (curl, scp).

References

  1. Microsoft. (n.d.). About the Clipboard. Retrieved March 29, 2016.
  2. Microsoft, JasonGerend, et al. (2023, February 3). clip. Retrieved June 21, 2022.
  3. CISA. (2021, August 20). Alert (AA21-200B) Chinese State-Sponsored Cyber Operations: Observed TTPs. Retrieved June 21, 2022.
  4. Maljic, T. (2020, April 16). Mining for malicious Ruby gems. Retrieved October 15, 2022.
  5. rvrsh3ll. (2016, May 18). Operating with EmPyre. Retrieved July 12, 2017.
  6. Brumaghin, E., et al. (2018, October 15). Old dog, new tricks - Analysing new RTF-based campaign distributing Agent Tesla, Loki with PyREbox. Retrieved November 5, 2018.
  7. Zhang, X. (2018, April 05). Analysis of New Agent Tesla Spyware Variant. Retrieved November 5, 2018.
  8. Zhang, X. (2017, June 28). In-Depth Analysis of A New Variant of .NET Malware AgentTesla. Retrieved November 5, 2018.
  9. Arsene, L. (2020, April 21). Oil & Gas Spearphishing Campaigns Drop Agent Tesla Spyware in Advance of Historic OPEC+ Deal. Retrieved May 19, 2020.
  10. FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 17, 2024.
  11. Symantec. (2018, February 28). Chafer: Latest Attacks Reveal Heightened Ambitions. Retrieved May 22, 2020.
  12. Salem, E. (2019, February 13). ASTAROTH MALWARE USES LEGITIMATE OS AND ANTIVIRUS PROCESSES TO STEAL PASSWORDS AND PERSONAL DATA. Retrieved April 17, 2019.
  13. Hromcova, Z. (2019, October). AT COMMANDS, TOR-BASED COMMUNICATIONS: MEET ATTOR, A FANTASY CREATURE AND ALSO A SPY PLATFORM. Retrieved May 6, 2020.
  14. Robert Falcone, Mike Scott, Juan Cortes. (2015, November 10). Bookworm Trojan: A Model of Modular Architecture. Retrieved July 21, 2025.
  15. Symantec Security Response. (2015, December 7). Iran-based attackers use back door threats to spy on Middle Eastern targets. Retrieved April 17, 2019.
  16. Balanza, M. (2018, April 02). Infostealer.Catchamas. Retrieved November 17, 2024.
  17. Jenkins, L. at al. (2022, August 4). ROADSWEEP Ransomware - Likely Iranian Threat Actor Conducts Politically Motivated Disruptive Activity Against Albanian Government Organizations. Retrieved August 6, 2024.
  18. Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.
  19. Chen, T. and Chen, Z. (2020, February 17). CLAMBLING - A New Backdoor Base On Dropbox. Retrieved November 12, 2021.
  20. F-Secure Labs. (2014, July). COSMICDUKE Cosmu with a twist of MiniDuke. Retrieved July 3, 2014.
  21. Kujawa, A. (2018, March 27). You dirty RAT! Part 1: DarkComet. Retrieved November 6, 2018.
  22. Adi Zeligson & Rotem Kerner. (2018, November 13). Enter The DarkGate - New Cryptocurrency Mining and Ransomware Campaign. Retrieved February 9, 2024.
  23. McGraw, T. (2024, December 4). Black Basta Ransomware Campaign Drops Zbot, DarkGate, and Custom Malware. Retrieved December 9, 2024.
  24. Secureworks Counter Threat Unit Research Team. (2022, August 17). DarkTortilla Malware Analysis. Retrieved November 3, 2022.
  25. Schroeder, W., Warner, J., Nelson, M. (n.d.). Github PowerShellEmpire. Retrieved April 28, 2016.
  26. Threat Intelligence and Research. (2015, March 30). VOLATILE CEDAR. Retrieved February 8, 2021.
  27. Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.
  28. Abramov, D. (2020, April 13). Grandoreiro Malware Now Targeting Banks in Spain. Retrieved November 12, 2020.
  29. Falcone, R. and Lee, B.. (2016, May 26). The OilRig Campaign: Attacks on Saudi Arabian Organizations Deliver Helminth Backdoor. Retrieved May 3, 2017.
  30. eSentire Threat Response Unit (TRU). (2024, November 14). Bored BeaverTail & InvisibleFerret Yacht Club – A Lazarus Lure Pt.2. Retrieved October 17, 2025.
  31. Matej Havranek. (2025, February 20). DeceptiveDevelopment targets freelance developers. Retrieved October 17, 2025.
  32. Unit 42. (2023, November 21). Hacking Employers and Seeking Employment: Two Job-Related Campaigns Bear Hallmarks of North Korean Threat Actors. Retrieved October 17, 2025.
  1. Seongsu Park. (2024, November 4). From Pyongyang to Your Payroll: The Rise of North Korean Remote Workers in the West. Retrieved October 17, 2025.
  2. Unit 42. (2017, December 15). Unit 42 Playbook Viewer. Retrieved December 20, 2017.
  3. Kamluk, V. & Gostev, A. (2016, February). Adwind - A Cross-Platform RAT. Retrieved April 23, 2019.
  4. Magius, J., et al. (2017, July 19). Koadic. Retrieved September 27, 2024.
  5. Rascagneres, P. (2017, May 03). KONNI: A Malware Under The Radar For Years. Retrieved November 5, 2018.
  6. ESET. (2019, July). MACHETE JUST GOT SHARPER Venezuelan government institutions under attack. Retrieved September 13, 2019.
  7. Kaspersky Global Research and Analysis Team. (2014, August 20). El Machete. Retrieved September 13, 2019.
  8. Patrick Wardle. (n.d.). Mac Malware of 2017. Retrieved September 21, 2018.
  9. GReAT. (2021, June 16). Ferocious Kitten: 6 Years of Covert Surveillance in Iran. Retrieved September 22, 2021.
  10. GReAT. (2020, July 14). The Tetrade: Brazilian banking malware goes global. Retrieved November 9, 2020.
  11. Zhang, X. (2020, February 4). Another Metamorfo Variant Targeting Customers of Financial Institutions in More Countries. Retrieved July 30, 2020.
  12. ESET Research. (2019, October 3). Casbaneiro: peculiarities of this banking Trojan that affects Brazil and Mexico. Retrieved September 23, 2021.
  13. Facundo Muñoz. (2023, April 26). Evasive Panda APT group delivers malware via updates for popular Chinese software. Retrieved July 25, 2024.
  14. Threat Hunter Team. (2023, April 20). Daggerfly: APT Actor Targets Telecoms Company in Africa. Retrieved July 25, 2024.
  15. ESET Security. (2019, November 19). Mispadu: Advertisement for a discounted Unhappy Meal. Retrieved March 13, 2024.
  16. Symantec Threat Hunter Team. (2023, October 19). Crambus: New Campaign Targets Middle Eastern Government. Retrieved November 27, 2024.
  17. Dantzig, M. v., Schamper, E. (2019, December 19). Operation Wocao: Shining a light on one of China’s hidden hacking groups. Retrieved October 8, 2020.
  18. Sudeep Singh. (2025, April 16). Latest Mustang Panda Arsenal: PAKLOG, CorKLOG, and SplatCloak | P2. Retrieved September 12, 2025.
  19. Klijnsma, Y. (2018, January 23). Espionage Campaign Leverages Spear Phishing, RATs Against Turkish Defense Contractors. Retrieved November 6, 2018.
  20. Legezo, D. (2019, January 30). Chafer used Remexi malware to spy on Iran-based foreign diplomatic entities. Retrieved April 17, 2019.
  21. Cash, D., Grunzweig, J., Adair, S., Lancaster, T. (2021, August 25). North Korean BLUELIGHT Special: InkySquid Deploys RokRAT. Retrieved October 1, 2021.
  22. Faou, M. and Boutin, J. (2017, February). Read The Manual: A Guide to the RTM Banking Trojan. Retrieved March 9, 2017.
  23. Duncan, B., Harbison, M. (2019, January 23). Russian Language Malspam Pushing Redaman Banking Malware. Retrieved June 16, 2020.
  24. Sherstobitoff, R., Saavedra-Morales, J. (2018, February 02). Gold Dragon Widens Olympics Malware Attacks, Gains Permanent Presence on Victims’ Systems. Retrieved June 6, 2018.
  25. byt3bl33d3r. (n.d.). SILENTTRINITY. Retrieved September 12, 2024.
  26. GReAT. (2019, April 10). Project TajMahal – a sophisticated new APT framework. Retrieved October 14, 2019.
  27. Cylance. (2014, December). Operation Cleaver. Retrieved September 14, 2017.
  28. Lancaster, T., Cortes, J. (2018, January 29). VERMIN: Quasar RAT and Custom Malware Used In Ukraine. Retrieved July 5, 2018.
  29. Nart Villeneuve, Randi Eitzman, Sandor Nemes & Tyler Dean, Google Cloud. (2017, October 5). Significant FormBook Distribution Campaigns Impacting the U.S. and South Korea. Retrieved March 11, 2025.
  30. Gustavo Palazolo, Netskope. (2022, March 11). New Formbook Campaign Delivered Through Phishing Emails. Retrieved March 11, 2025.
  31. Ebach, L. (2017, June 22). Analysis Results of Zeus.Variant.Panda. Retrieved November 5, 2018.