Skip to main content

Clipboard Hijacking Attacks

Clipboard hijacking silently replaces what you copy — crypto addresses, passwords, and bank details. It's invisible, automatic, and has cost millions in stolen cryptocurrency.

Sarah Chen — Lead Security Editor
Sarah Chen·CISSPCompTIA Security+·Lead Security Editor
Updated
Protect yourself

Our Top 4 VPN Picks

Chosen after real-world testing across speed, privacy, and streaming. Each ranking is independent — we buy every VPN at retail and test it ourselves.

EDITOR'S PICK
NordVPN logo
Best Overall
NordVPN
4.8/ 5

Fastest speeds, audited no-logs, 6000+ servers

Audited no-logs policyThreat Protection blocks malware10 devices per account30-day money-back guarantee
Save 74%
was $12.99/mo
$3.39/mo
Get NordVPN
30-day money-back guarantee
Read full NordVPN review
Surfshark logo
Best for Unlimited Devices
Surfshark
4.6/ 5

Unlimited devices, CleanWeb blocker, 100+ countries

Unlimited simultaneous devicesCleanWeb ad & malware blockerRAM-only server network30-day money-back guarantee
Save 87%
was $15.45/mo
$1.99/mo
Get Surfshark
30-day money-back guarantee
Read full Surfshark review
Proton VPN logo
Best for Privacy
Proton VPN
4.5/ 5

Swiss privacy laws, open-source, free tier

Swiss jurisdiction (no data laws)Open-source and auditedSecure Core multi-hopFree tier available forever
50% off
was $9.99/mo
$4.99/mo
Get Proton VPN
30-day money-back guarantee
Read full Proton VPN review
FastestVPN logo
Best Budget
FastestVPN
4.2/ 5

Lifetime plans, 10 devices, ad blocker

Lifetime deal available10 devices per accountBuilt-in ad blockerNo-logs policy
Save 89%
was $10/mo
$1.11/mo
Get FastestVPN
30-day money-back guarantee
Read full FastestVPN review

We earn a commission when you click “Get” buttons, at no extra cost to you. Read our affiliate disclosure

How It Works

  1. 1. Infection: Malware installed via phishing, malicious download, or compromised software
  2. 2. Monitoring: Malware runs silently in the background, watching clipboard content
  3. 3. Pattern matching: When you copy something that matches a pattern (crypto address, bank number, URL), the malware activates
  4. 4. Replacement: Your clipboard content is instantly replaced with the attacker's data
  5. 5. You paste: Without checking, you paste the attacker's address/number instead of the intended one
  6. 6. Theft: Crypto sent to wrong wallet. Payment made to wrong account. Irreversible.

What Gets Targeted

Cryptocurrency Addresses

Critical

Bitcoin, Ethereum, and other crypto addresses replaced with attacker's wallet. Transactions are irreversible.

Bank Account Numbers

High

IBAN, routing numbers, and account details swapped during copy-paste for wire transfers.

Payment Links

High

PayPal, Venmo, and payment URLs modified to redirect to attacker-controlled accounts.

Passwords

Medium

Less common but possible — copied passwords modified to log you into attacker-controlled sites.

Protection

1

Always verify after pasting

Check that pasted content matches what you copied. For crypto: verify first AND last 6 characters.

2

Use QR codes for crypto

Scan QR codes instead of copy-pasting addresses. Harder for malware to intercept.

3

Send test transactions

For large crypto or wire transfers, send a tiny amount first to verify the recipient.

4

Keep software updated

Clipboard malware exploits known vulnerabilities. Updates patch these.

5

Run endpoint protection

Windows Defender, Malwarebytes, or similar detects most clipboard hijackers.

6

Don't download from untrusted sources

Pirated software, game cracks, and unofficial apps are common clipboard malware vectors.

Frequently asked

Frequently Asked Questions

Malware that monitors your clipboard and replaces copied content with the attacker's data. Most commonly used to swap cryptocurrency wallet addresses — you copy your friend's address, the malware replaces it with the attacker's, and your crypto goes to the wrong wallet.
Always verify what you paste matches what you copied. For crypto: check the first and last 6 characters of the address after pasting. For passwords: paste into a visible text field first. If what appears doesn't match what you copied, you may have clipboard malware.
No — clipboard hijacking is local malware on your device, not a network attack. A VPN protects network traffic. You need antivirus/endpoint protection, safe downloading habits, and verification practices to prevent clipboard attacks.

Keep reading

Related Guides