Clipboard Hijacking Malware: Signs and What to Do
Fact-checked on
In this article
Clipboard hijacking malware interferes with information you copy and paste. A common example is a “crypto clipper” that replaces a copied cryptocurrency wallet address with an attacker’s address. If you paste it into a payment screen without checking, you could send money to the wrong recipient.
The same practical rule applies to other sensitive details: copying something correctly does not prove that the pasted version is correct.
Clipboard hijacking and ClickFix are different
Microsoft has documented malware that monitors the clipboard and substitutes cryptocurrency addresses. That requires malicious software to be running on the device.
A ClickFix scam instead persuades you to paste and run a command, often while pretending to fix a browser error or complete a CAPTCHA. A malicious page can put text on the clipboard and tell you to execute it. Seeing such a page does not, by itself, prove that your device is already infected.
Warning: Never run a pasted command because a website says it is necessary to prove you are human, view a document or repair your browser.
Warning signs
A pasted payment address that repeatedly differs from the copied address deserves investigation. Unexpected security alerts, unknown software or a recent download from an untrusted source add to the concern. However, a typing mistake or an ordinary application problem can also cause unexpected text; one strange paste is not a diagnosis.
You can inspect copied text in a plain-text editor without running it. Do not paste a suspicious command into a terminal, command prompt or Run box. Before any payment, compare the entire destination address and confirm the intended recipient through a trusted channel.
What to do if you suspect an infection
- Pause payments and sensitive logins on that device. If it is a work computer, contact your IT team and follow its incident procedure.
- Update your operating system and security software. Run a full malware scan. On Windows, the Windows Security app provides scan options; Microsoft Defender Offline is another option for investigating persistent threats and restarts the computer, so save your work first.
- Remove suspicious software through trusted security guidance. Do not download a “clipboard cleaner” from an advert or a pop-up claiming to have detected a virus.
- Secure exposed accounts from a clean device. Change affected passwords, review sign-ins and enable multifactor authentication. If wallet recovery phrases or private keys may have been exposed, seek the wallet provider’s security guidance.
- Act quickly on a wrong payment. Contact the bank, payment provider or exchange through its official support channel. Keep transaction references. Recovery is not guaranteed.
- Report the incident through Kenya’s National KE-CIRT/CC reporting page where appropriate.
Clearing the clipboard or using private browsing does not remove malware. Prevention depends on trusted downloads, current software and checking the destination before confirming a transaction.
