Procedure examples

PAKLOG has monitored and extracted clipboard contents.

Zeus Panda can hook GetClipboardData function to watch for clipboard pastes to collect.

InvisibleFerret has stolen data from the clipboard using the Python project “pyperclip”. InvisibleFerret has also captured clipboard contents during copy and paste operations.

BOOKWORM has used its KBLogger.dll module to steal data saved to the clipboard.

CosmicDuke copies and exfiltrates the clipboard contents every 30 seconds.

Machete hijacks the clipboard data by creating an overlapped window that listens to keyboard events.

FlawedAmmyy can collect clipboard data.

Mispadu has the ability to capture and replace Bitcoin wallet data in the clipboard on a compromised host.

VERMIN collects data stored in the clipboard.

MarkiRAT can capture clipboard content.

DarkComet can steal data from the clipboard.

CHIMNEYSWEEP can capture content from the clipboard.

DarkTortilla can download a clipboard information stealer module.

ROKRAT can extract clipboard data from a compromised host.

RunningRAT contains code to open and copy data from the clipboard.

Explosive has a function to use the OpenClipboard wrapper.

Clambling has the ability to capture and store clipboard data.

DarkGate starts a thread on execution that captures clipboard data and logs it to a predefined log file.

Metamorfo has a function to hijack data from the clipboard by monitoring the contents of the clipboard and replacing the cryptocurrency wallet with the attacker's.

KONNI had a feature to steal data from the clipboard.

A JHUHUGIT variant accesses a screenshot saved in the clipboard and converts it to a JPG image.

Catchamas steals data stored in the clipboard.

Attor has a plugin that collects data stored in the Windows clipboard by using the OpenClipboard and GetClipboardData APIs.

RTM collects data from the clipboard.

Grandoreiro can capture clipboard data from a compromised host.

XLoader can collect data stored in the victim's clipboard.

MgBot can capture clipboard data.

Cadelspy has the ability to steal data from the clipboard.

TajMahal has the ability to steal data from the clipboard of an infected host.

TinyZBot contains functionality to collect information from the clipboard.

Melcoz can monitor content saved to the clipboard.

Agent Tesla can steal data from the victim’s clipboard.

Remexi collects text from the clipboard.

Astaroth collects information from the clipboard by using the OpenClipboard() and GetClipboardData() libraries.

jRAT can capture clipboard data.

The executable version of Helminth has a module to log clipboard contents.

MacSpy can steal clipboard contents.

SILENTTRINITY can monitor Clipboard text and can use `System.Windows.Forms.Clipboard.GetText()` to collect data from the clipboard.

Empire can harvest clipboard data on both Windows and macOS systems.

Remcos steals and modifies data from the clipboard.

Koadic can retrieve the current content of the user clipboard.