Skip to main content
Threat playbook

Category: Data Theft & Leakage

Clipboard hijacking and ClickFix

Clipboard hijacking reads or changes what you copy. Crypto clippers swap wallet addresses as you paste.

Fake CAPTCHA pages copy a command for you to paste. That trick is called ClickFix. No real CAPTCHA asks you to open Run or Terminal. Check pasted addresses character by character.

Copy and paste moves money and secrets. One swapped string can redirect a payment.

Updated 2026-10-30

What is a ClickFix or fake CAPTCHA attack?

MITRE T1204.004 calls it malicious copy and paste. A page shows a fake error or CAPTCHA. Its button copies a hidden command to your clipboard. Then the page tells you to paste and run it.

Microsoft saw ClickFix target thousands of devices daily in 2025. Lures arrived through phishing, malicious ads, and hacked sites.

Related lures: fake browser updates.

  1. A page shows a fake error, update, or CAPTCHA.
  2. Clicking its button copies a command to your clipboard.
  3. The page tells you to open Run or a terminal.
  4. Pasting and running the command installs malware.

What kinds of clipboard attacks are there?

MITRE T1115 covers malware that reads and replaces clipboard data. Its examples include malware that swaps cryptocurrency wallet addresses.

Clipboard attacks and their tells. Sources: MITRE T1204.004 and MITRE T1115.
AttackWhat it does to the clipboardHow to spot it
ClickFix paste-and-runPlaces a malicious command there for you to runA web page asks you to open Run or Terminal
Crypto clipperSwaps a copied wallet address for the attacker'sThe pasted address differs from the source
Clipboard snoopingReads codes, keys, or passwords you copyUnexpected paste prompts from a site
Extension with clipboard accessReads or rewrites copies on any siteClipboard access in the extension's permissions. See malicious browser extensions.

Clipboard attacks and their tells. Sources: MITRE T1204.004 and MITRE T1115.

Can websites read your clipboard?

Only within limits. MDN says the Clipboard API works only on secure pages. Chromium browsers ask for a clipboard-read permission. Firefox and Safari show a one-time Paste prompt instead. Writing usually needs a recent click or key press.

Extensions play by different rules. In Firefox, extensions with clipboard permission skip the prompt.

How do you protect copied crypto addresses?

  1. Copy the address from the trusted source.
  2. After pasting, compare it character by character.
  3. Matching only the first and last characters is not enough.
  4. Send a small test amount before a large transfer.
  5. Confirm new payment details through a second channel.

Why do security tools miss clipboard attacks?

  • You run the command yourself, so it looks legitimate.
  • Clipboard access is legitimate for many apps.
  • People rarely re-read long strings after pasting.
  • Swapped addresses can look almost identical at a glance.

What clipboard rules work for teams?

  • Teach one rule: never paste website commands into Run.
  • Disable the Run dialog where staff do not need it.
  • Use Chrome's DefaultClipboardSetting policy to deny clipboard access.
  • Audit extensions that request clipboard access.
  • Verify payee changes out of band.
  • Keep secrets out of web forms you do not trust.

Does browser isolation protect the clipboard?

  • Shield opens a page in an isolated browser off your device.
  • Downloads and copied data cross that boundary.
  • Check anything you paste from an isolated page.
  • Never paste a website's command into your own terminal.
Add to Chrome

Limits

  • Clipboard permissions differ by browser and version.
  • This page covers browser clipboard abuse, not all malware.
  • Sources were checked on October 30, 2026.
  • Legba publishes this guide. Shield is part of Legba's Chrome extension.

FAQs.

Why would a site tell me to paste into Run?
To make you install malware yourself. That is the ClickFix trick. Close the page.
Can websites read my clipboard?
Only within limits. Chromium browsers ask for permission. Firefox and Safari show a Paste prompt.
Can a browser extension read my clipboard?
Yes, if it has clipboard permission. Check permissions before installing.
How do we reduce risk for finance teams?
Verify payout changes out of band. Restrict clipboard permissions by policy. Audit extensions that read the clipboard.
Is clipboard access always dangerous?
No, many tools need it. Grant it only to sites and extensions you trust.
What is a crypto clipper?
It is malware that watches your clipboard. It replaces copied wallet addresses with the attacker's.
How does browser isolation help?
It moves page code off your device. Copied data still crosses over, so check what you paste.

References

  1. 01
    MITRE ATT&CK: User Execution: Malicious Copy and Paste (T1204.004)MITRE
  2. 02
    MITRE ATT&CK: Clipboard Data (T1115)MITRE
  3. 03
    Microsoft: Think before you Click(Fix): Analyzing the ClickFix social engineering techniqueMicrosoft
  4. 04
    MDN: Clipboard APIMozilla
  5. 05
    Chrome Enterprise: PoliciesGoogle

Keep exploring

Try it on the next page you do not trust

Legba is a Chrome extension with two modes. Ghost gives you a private browser route. Shield opens a page in an isolated browser off your device.

Add to Chrome

Free for 30 days. No card required.

Ghost. A private route for your browser. Shield. An isolated browser, off your device. Choose the mode. Close when finished.