T1115

Official Description

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

For example, on Windows adversaries can access clipboard data by using <code>clip.exe</code> or <code>Get-Clipboard</code>.(Citation: MSDN Clipboard)(Citation: clip_win_server)(Citation: CISA_AA21_200B) Additionally, adversaries may monitor then replace users’ clipboard with their data (e.g., [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002)).(Citation: mining_ruby_reversinglabs)

macOS and Linux also have commands, such as <code>pbpaste</code>, to grab clipboard contents.(Citation: Operating with EmPyre)

Tactics: Collection
Platforms: Linux, macOS, Windows
MITRE Version: 1.2
Last Modified: May 12, 2026

View on MITRE ATT&CK ↗

Reported Context (4)

Cited open-source reporting identifies clipboard-content collection among Remus capabilities. CIS Links SLTT Remus C2 Traffic to Three Malware Delivery Chains
The macOS script transmitted clipboard data to an external server. JSCEAL Malware Spread Through Fake Cryptocurrency Exchange Ads on Facebook
Some Kothamine builds could access clipboard contents. Kothamine RAT Uses Tailscale’s Tailcat for Encrypted Command-and-Control
ZigCryptoStealer polled the clipboard for cryptocurrency addresses and could replace matching values. ClearFake WebDAV Chains Deliver Amatera, ZigCryptoStealer and Unauthorized NetSupport

Malware (9)

Threat Actors (4)

MITRE ATT&CK (29)

Vendors (4)

Products (17)

Tools (9)

Industries (1)

Countries (8)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.