📋 Clipboard Hijacking: How Malware Steals the Passwords You Copy (2026)
The 3 seconds between copying a password and pasting it is all a clipboard hijacker needs. Infostealer malware families like RedLine Stealer, LummaC2, and Vidar poll your clipboard every one or two seconds and transmit anything they find to an attacker's server, without making a sound, without slowing your computer, and without any notification you'd recognise as suspicious. You never know the password was captured until the account shows up in a breach report weeks later.
How clipboard hijacking actually works
Every time you press Ctrl+C or select Copy, your operating system stores the copied text in a small memory buffer called the clipboard. Any application on your computer can read the clipboard at any time, with no special permission required on Windows.
Clipboard-monitoring malware exploits this by running a background process that checks the clipboard contents every one or two seconds. The process is lightweight: it uses a tiny fraction of CPU time and generates almost no network traffic between checks. When a new string appears on the clipboard, the malware compares it against patterns. Strings that look like passwords, email addresses, credit card numbers, or cryptocurrency wallet addresses get immediately copied and sent out.
The CISA and NCSC both classify clipboard monitoring as one of the standard data exfiltration techniques used by commercial infostealer malware. Unlike a keylogger, which records every keystroke and produces enormous amounts of data to sift through, a clipboard monitor captures only what you deliberately copied. The data is high value and low volume, which makes detection harder.
Which malware families use clipboard hijacking
Clipboard monitoring is not a niche technique. It is a standard feature in the most widely distributed infostealers available on criminal forums in 2026.
- RedLine Stealer: First documented in 2020 and continuously updated. Sold as a subscription service for as little as $200 per month. Captures clipboard contents, saved browser passwords, session cookies, and cryptocurrency wallet files. Widely deployed through phishing emails and fake software downloads.
- LummaC2: A newer and more capable variant, significantly updated in 2024 and 2025. Includes an active clipboard-swap feature: when it detects a cryptocurrency wallet address in the clipboard, it replaces the copied address with the attacker's wallet address before you paste. You send funds to the attacker believing you are sending to your intended recipient.
- Vidar Stealer: Widely used against Windows systems. Captures browser history, saved credentials, authentication cookies, and clipboard contents. Delivered frequently via malicious email attachments disguised as invoices or shipping notifications.
- Raccoon Stealer v2: After law enforcement action dismantled the original operation, a second version appeared. Clipboard monitoring is included as a default feature in both versions.
All four of these are commercially sold, meaning they are available to anyone willing to pay. Technical skill is not a barrier to deploying them.
What data clipboard hijacking targets
The threat is not limited to passwords. Any text that passes through the clipboard is at risk.
| Data type | How it ends up on the clipboard | Consequence if captured |
|---|---|---|
| Passwords | Copied from a password manager or a saved note | Account takeover |
| Crypto wallet addresses | Copied to paste into a send-funds form | Funds redirected to attacker (via clipboard swap) |
| Credit and debit card numbers | Copied from an email or a document | Fraudulent transactions |
| TOTP codes | Copied from an authenticator app | MFA bypass if used immediately |
| Recovery codes | Copied when first generated during account setup | Full account takeover with no recovery |
| Email addresses | Copied during account setup or login | Used in targeted phishing |
The cryptocurrency clipboard-swap: a specific warning
LummaC2's clipboard-swap attack deserves its own section because the mechanism is both simple and financially devastating. The malware checks clipboard contents for patterns matching cryptocurrency addresses. Bitcoin addresses begin with 1, 3, or bc1. Ethereum addresses begin with 0x. When the malware detects one of these patterns, it overwrites the clipboard entry with an attacker-controlled address that superficially resembles the original.
Most people copy a wallet address, glance at the first three characters, and paste. They do not check all 34 to 42 characters. The attacker counts on this. Transactions on most blockchains are irreversible once confirmed. There is no chargeback mechanism and no recovery path if you send funds to the wrong address.
How infostealers reach your device
Clipboard hijackers don't install themselves. They arrive via one of a small number of well-documented delivery methods.
- Phishing email attachments. A fake invoice, shipping notification, or job offer arrives with a file attached: a Word document with macros enabled, a password-protected ZIP, or a disguised executable. Opening it runs the installer.
- Fake software downloads. A search for a cracked or free version of paid software leads to a result that bundles an infostealer alongside the promised installer. Game mods, video converters, and VPN clients are frequently faked this way.
- Malvertising. Ads on legitimate websites that redirect to pages pushing malicious downloads. Google Ads has been used repeatedly by infostealer distributors to show fake download pages for popular software.
- Drive-by downloads. Visiting a compromised website with an unpatched browser can trigger an automatic download without any click from the user.
Six things that reduce your exposure
1. Use a password manager with autofill
A password manager that fills login forms via a browser extension is the single most direct defense against clipboard hijacking. When the extension fills a username and password directly into the login form, the credentials never touch the clipboard. There is nothing for the malware to capture.
This is the behavior NCSC recommends: "Using a password manager can help you generate, store and fill in your passwords automatically. This also reduces the risk of you accidentally typing your password into a fake website." Autofill also avoids that risk.
NordPass uses a browser extension that fills credentials directly, so your passwords never pass through the clipboard unless you manually copy them. Bitwarden's free tier does the same. The change in your workflow: stop copying passwords, let the extension fill them instead.
2. Keep antivirus definitions current
RedLine, Vidar, and Raccoon are all detected by major antivirus products. Detection depends on up-to-date signatures. An antivirus that hasn't updated in two weeks may miss newer variants. Enable automatic updates and run a full scan if you suspect infection. Kaspersky's products detect clipboard-monitoring malware under the Trojan-PSW and Trojan-Spy families.
3. Never open unexpected email attachments
If you were not expecting a file, do not open it. This applies to invoices from suppliers you don't recognise, delivery notifications for orders you didn't place, and job opportunities you didn't apply for. Verify the sender through a separate channel before opening anything.
4. Download software only from official sources
Install software from the developer's official website or your operating system's app store. Avoid search results for "free download" or "cracked version" of any paid application. The cost of the malware infection will always exceed the cost of the software you were trying to avoid buying.
5. Clear the clipboard after sensitive operations
On Windows 10 and 11, open Clipboard History with Win+V and delete individual entries, or select "Clear all." On macOS, copy a harmless piece of text (the word "done", for example) immediately after pasting credentials. This overwrites the sensitive content. On both platforms, restarting the device clears the clipboard.
6. Keep your browser and operating system updated
Drive-by download attacks exploit unpatched browser vulnerabilities. A browser that is two versions behind may have publicly known security flaws. Enable automatic updates for your browser, operating system, and any plugins like PDF readers.
What to do if you think clipboard hijacking is already happening
The clearest sign is clipboard content that changes between copying and pasting. Paste a test string of characters, switch tabs, and paste again. If the second paste is different, treat the device as compromised.
- Disconnect from Wi-Fi immediately to stop ongoing data exfiltration.
- Run a full scan with updated antivirus software. Malwarebytes, Windows Defender Offline Scan, and Kaspersky's threat scanner are all capable of detecting the common infostealer families.
- Change all passwords that could have been captured, starting with email, banking, and any accounts where you used two-factor authentication via copied codes. Do this from a different, clean device.
- Check your email for any sign-in alerts from unfamiliar locations. Most email providers now list recent sessions with IP addresses and device types.
- If you copied any cryptocurrency addresses during the suspected infection window, assume those transactions may have been redirected and check your blockchain transaction history.
Autofill versus clipboard: the practical difference
At a glance
- Password manager with autofill: Fills the login form directly. Password never touches the clipboard. Best defense against clipboard hijacking.
- Copying from a manager manually: Password sits on the clipboard for the duration of the copy-paste sequence. Vulnerable to clipboard monitoring.
- Writing a password from memory: No clipboard exposure, but short memorable passwords are weak. Keyloggers still capture keystrokes.
- Saving to notes or a spreadsheet: Password is unencrypted and frequently copied. High risk.
The conclusion from CISA's guidance on credential security is consistent with this: use a password manager, let it autofill, and generate a unique password for every account. Removing copy-paste from the equation removes a category of attack entirely.
Frequently asked questions
Can clipboard hijacking affect Macs?
Yes. macOS malware with clipboard monitoring exists, though Windows variants are more common and numerically greater. From macOS Monterey onwards, apps must request explicit clipboard access permission. Any application requesting clipboard access that you don't recognise should be treated with suspicion and investigated before granting the permission.
Does a VPN protect against clipboard hijacking?
No. A VPN encrypts traffic between your device and a remote server. Clipboard hijacking is a local attack: malware reads your clipboard on the device itself, before any data crosses the network. The data leaves your device encrypted by the VPN just like any other traffic. A VPN does not inspect what it is transmitting, and it does not stop malware from capturing credentials locally.
Is it safe to use a browser-based password generator that requires copying the result?
On a device you are confident is clean, the risk from briefly exposing a generated password on the clipboard is low. The NCSC recommends using a full password manager with autofill for accounts you access regularly. For one-off low-stakes registrations, a generator is convenient and acceptable. For banking, email, and anything tied to financial accounts, use a password manager and let the extension fill the form.
Will a password manager protect me if I am already infected?
Not fully. If clipboard-monitoring malware is already running, no single application can guarantee protection. The master password for your manager is at risk from keyloggers. The priority is to remove the infection first: disconnect from the internet, run a full offline malware scan, clean the infection, then change all passwords from a known-clean device. After that, re-enroll in your password manager and change the master password too.
The bottom line
Clipboard hijacking sits in a gap that most people don't know exists: the three seconds between copying a password and pasting it. The fix is not complicated. A password manager with a browser extension fills login forms without using the clipboard at all. That one change in habit closes the attack vector entirely for the majority of logins.
Use a password manager that autofills, keep antivirus updated, and stop downloading software from unofficial sources. Clipboard hijackers are common, they're silent, and they're cheap to deploy. The defenses against them are also cheap and, in the case of autofill, make your day-to-day logins faster rather than slower.
Generate a strong password now
This article contains affiliate links. If you purchase through these links, FreeStrongPassword.com earns a commission at no extra cost to you. See our affiliate disclosure.