H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Technique

Clipboard Data

Adversaries may collect data stored in the clipboard from users copying information within or between applications. For example, on Windows adversaries can access clipboard data by using clip.exe or Get-Clipboard .(Citation: MSDN Clipboard)(Citation: clip_win_server)(Citation: CISA_AA21_200B) Additionally, adversaries may monitor then replace users’ clipboard with their data (e.g., [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002)).(Citation: mining_ruby_reversinglabs) macOS and Linux also have commands, such as pbpaste , to grab clipboard contents.(Citation: Operating with EmPyre)

Technique
TypeTechnique
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

Adversaries may collect data stored in the clipboard from users copying information within or between applications. For example, on Windows adversaries can access clipboard data by using clip.exe or Get-Clipboard .(Citation: MSDN Clipboard)(Citation: clip_win_server)(Citation: CISA_AA21_200B) Additionally, adversaries may monitor then replace users’ clipboard with their data (e.g., [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002)).(Citation: mining_ruby_reversinglabs) macOS and Linux also have commands, such as pbpaste , to grab clipboard contents.(Citation: Operating with EmPyre)

47 recorded

Relationships

mapped-to
from Collect Data from Clipboard
Technique
uses
from Agent Tesla
Malware
uses
from APT38
Group
uses
from APT39
Group
uses
from Astaroth
Malware
uses
from Attor
Malware
uses
from BOOKWORM
Malware
uses
from Cadelspy
Malware
uses
from Catchamas
Malware
uses
from CHIMNEYSWEEP
Malware
uses
from Clambling
Malware
uses
from CosmicDuke
Malware
uses
from DarkComet
Malware
uses
from DarkGate
Malware
uses
from DarkTortilla
Malware
uses
from Empire
Tool
uses
from Explosive
Malware
uses
from FlawedAmmyy
Malware
uses
from Grandoreiro
Malware
uses
from Helminth
Malware
uses
from InvisibleFerret
Malware
uses
from JHUHUGIT
Malware
uses
from jRAT
Malware
uses
from Kimsuky
Group
uses
from Koadic
Tool
uses
from KONNI
Malware
uses
from Machete
Malware
uses
from MacSpy
Malware
uses
from MarkiRAT
Malware
uses
from Melcoz
Malware
uses
from Metamorfo
Malware
uses
from MgBot
Malware
uses
from Mispadu
Malware
uses
from OilRig
Group
uses
from Operation Wocao
Campaign
uses
from PAKLOG
Malware
uses
from Remcos
Tool
uses
from Remexi
Malware
uses
from ROKRAT
Malware
uses
from RTM
Malware
uses
from RunningRAT
Malware
uses
from SILENTTRINITY
Tool
uses
from TajMahal
Malware
uses
from TinyZBot
Malware
uses
from VERMIN
Malware
uses
from XLoader
Malware
uses
from Zeus Panda
Malware
6 external

References

mitre-attack
T1115
open
CISA_AA21_200B
https://www.cisa.gov/uscert/ncas/alerts/aa21-200b
open
mining_ruby_reversinglabs
https://blog.reversinglabs.com/blog/mining-for-malicious-ruby-gems
open
clip_win_server
https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/clip
open
MSDN Clipboard
https://msdn.microsoft.com/en-us/library/ms649012
open
Operating with EmPyre
https://medium.com/rvrsh3ll/operating-with-empyre-ea764eda3363
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance