Description
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
For example, on Windows adversaries can access clipboard data by using clip.exe or Get-Clipboard.(Citation: MSDN Clipboard)(Citation: clip_win_server)(Citation: CISA_AA21_200B) Additionally, adversaries may monitor then replace users’ clipboard with their data (e.g., Transmitted Data Manipulation).(Citation: mining_ruby_reversinglabs)
macOS and Linux also have commands, such as pbpaste, to grab clipboard contents.(Citation: Operating with EmPyre)
Platforms
Threat Groups (4)
| ID | Group | Context |
|---|---|---|
| G0082 | APT38 | [APT38](https://attack.mitre.org/groups/G0082) used a Trojan called KEYLIME to collect data from the clipboard.(Citation: FireEye APT38 Oct 2018) |
| G0094 | Kimsuky | [Kimsuky](https://attack.mitre.org/groups/G0094) has the ability to steal data from the clipboard.(Citation: Aryaka Kimsuky July 2025) |
| G0087 | APT39 | [APT39](https://attack.mitre.org/groups/G0087) has used tools capable of stealing contents of the clipboard.(Citation: Symantec Chafer February 2018) |
| G0049 | OilRig | [OilRig](https://attack.mitre.org/groups/G0049) has used infostealer tools to copy clipboard data.(Citation: Symantec Crambus OCT 2023) |
Associated Software (41)
| ID | Name | Type | Context |
|---|---|---|---|
| S1233 | PAKLOG | Malware | [PAKLOG](https://attack.mitre.org/software/S1233) has monitored and extracted clipboard contents.(Citation: Zscaler PAKLOG CorkLog SplatCloak Splatdro... |
| S0330 | Zeus Panda | Malware | [Zeus Panda](https://attack.mitre.org/software/S0330) can hook GetClipboardData function to watch for clipboard pastes to collect.(Citation: GDATA Zeu... |
| S1245 | InvisibleFerret | Malware | [InvisibleFerret](https://attack.mitre.org/software/S1245) has stolen data from the clipboard using the Python project “pyperclip”.(Citation: Esentire... |
| S1226 | BOOKWORM | Malware | [BOOKWORM](https://attack.mitre.org/software/S1226) has used its KBLogger.dll module to steal data saved to the clipboard. (Citation: Unit42 Bookworm ... |
| S0050 | CosmicDuke | Malware | [CosmicDuke](https://attack.mitre.org/software/S0050) copies and exfiltrates the clipboard contents every 30 seconds.(Citation: F-Secure Cosmicduke) |
| S0409 | Machete | Malware | [Machete](https://attack.mitre.org/software/S0409) hijacks the clipboard data by creating an overlapped window that listens to keyboard events.(Citati... |
| S0381 | FlawedAmmyy | Malware | [FlawedAmmyy](https://attack.mitre.org/software/S0381) can collect clipboard data.(Citation: Korean FSI TA505 2020) |
| S1122 | Mispadu | Malware | [Mispadu](https://attack.mitre.org/software/S1122) has the ability to capture and replace Bitcoin wallet data in the clipboard on a compromised host.(... |
| S0257 | VERMIN | Malware | [VERMIN](https://attack.mitre.org/software/S0257) collects data stored in the clipboard.(Citation: Unit 42 VERMIN Jan 2018) |
| S0652 | MarkiRAT | Malware | [MarkiRAT](https://attack.mitre.org/software/S0652) can capture clipboard content.(Citation: Kaspersky Ferocious Kitten Jun 2021) |
| S0334 | DarkComet | Malware | [DarkComet](https://attack.mitre.org/software/S0334) can steal data from the clipboard.(Citation: Malwarebytes DarkComet March 2018) |
| S1149 | CHIMNEYSWEEP | Malware | [CHIMNEYSWEEP](https://attack.mitre.org/software/S1149) can capture content from the clipboard.(Citation: Mandiant ROADSWEEP August 2022) |
| S1066 | DarkTortilla | Malware | [DarkTortilla](https://attack.mitre.org/software/S1066) can download a clipboard information stealer module.(Citation: Secureworks DarkTortilla Aug 20... |
| S0240 | ROKRAT | Malware | [ROKRAT](https://attack.mitre.org/software/S0240) can extract clipboard data from a compromised host.(Citation: Volexity InkySquid RokRAT August 2021) |
| S0253 | RunningRAT | Malware | [RunningRAT](https://attack.mitre.org/software/S0253) contains code to open and copy data from the clipboard.(Citation: McAfee Gold Dragon) |
| S0569 | Explosive | Malware | [Explosive](https://attack.mitre.org/software/S0569) has a function to use the OpenClipboard wrapper.(Citation: CheckPoint Volatile Cedar March 2015) |
| S0660 | Clambling | Malware | [Clambling](https://attack.mitre.org/software/S0660) has the ability to capture and store clipboard data.(Citation: Trend Micro DRBControl February 20... |
| S1111 | DarkGate | Malware | [DarkGate](https://attack.mitre.org/software/S1111) starts a thread on execution that captures clipboard data and logs it to a predefined log file.(Ci... |
| S0455 | Metamorfo | Malware | [Metamorfo](https://attack.mitre.org/software/S0455) has a function to hijack data from the clipboard by monitoring the contents of the clipboard and ... |
| S0356 | KONNI | Malware | [KONNI](https://attack.mitre.org/software/S0356) had a feature to steal data from the clipboard.(Citation: Talos Konni May 2017) |
References
- CISA. (2021, August 20). Alert (AA21-200B) Chinese State-Sponsored Cyber Operations: Observed TTPs. Retrieved June 21, 2022.
- Maljic, T. (2020, April 16). Mining for malicious Ruby gems. Retrieved October 15, 2022.
- Microsoft, JasonGerend, et al. (2023, February 3). clip. Retrieved June 21, 2022.
- Microsoft. (n.d.). About the Clipboard. Retrieved March 29, 2016.
- rvrsh3ll. (2016, May 18). Operating with EmPyre. Retrieved July 12, 2017.
Frequently Asked Questions
What is T1115 (Clipboard Data)?
T1115 is a MITRE ATT&CK technique named 'Clipboard Data'. It belongs to the Collection tactic(s). Adversaries may collect data stored in the clipboard from users copying information within or between applications. For example, on Windows adversaries can access clipboard data by using <code>clip....
How can T1115 be detected?
Detection of T1115 (Clipboard Data) typically involves monitoring system logs, network traffic, and endpoint telemetry. Use SIEM rules, EDR solutions, and behavioral analytics to identify suspicious activity associated with this technique.
What mitigations exist for T1115?
Follow defense-in-depth principles including network segmentation, least privilege access, security monitoring, and regular patching to reduce the risk of this technique.
Which threat groups use T1115?
Known threat groups using T1115 include: APT38, Kimsuky, APT39, OilRig.