How do you detect clipboard hijacking and crypto clippers?

Detect clippers in three ways. Statically, scan user-writable paths and attachments for executables that combine clipboard APIs (OpenClipboard, SetClipboardData, AddClipboardFormatListener) with several wallet-address regex patterns. Behaviourally, look for small unsigned processes with no visible window that start at logon and register clipboard listeners, where your EDR exposes that telemetry. Operationally, run a clipboard canary: set a valid address you control, wait, and read it back. A changed value with no user action proves a swap. Require out-of-band address verification for transfers.

Detecting Clipboard Hijacking and Crypto Clippers

Clippers are small, quiet programs that monitor the clipboard, match anything that looks like a cryptocurrency address and replace it with an attacker-controlled one. They are often bundled into stealers and loaders. Because the clipboard APIs are legitimate and widely used, detection leans on three things: what the binary contains, what it does at startup, and a canary that proves the swap is happening.

Signals at a Glance

Signal	Where	ATT&CK
Binary containing clipboard APIs and several wallet-address regex patterns	YARA, file scanning	T1115
Clipboard content changes without a user paste or copy action	Canary test, EDR API telemetry	T1115
Small unsigned process with a hidden window, started at logon	EDR, autoruns baseline	T1547.001
Clipboard listener registered by a process with no UI	EDR API-call telemetry (product dependent)	T1115
Clipper bundled with a stealer or loader on the same host	Correlated alerts	T1005

Static Hunting for Clipper Logic

A clipper has to carry the patterns it matches. Address formats are regular expressions, and .NET or native clippers embed them as plain or UTF-16 strings alongside the clipboard API names. That combination is rare in legitimate software and worth a scheduled scan of user-writable paths and email attachments:

rule HUNT_Clipper_WalletRegex_ClipboardAPIs
{
    meta:
        description = "Hunt: PE with clipboard APIs and multiple wallet-address patterns"
        note = "tune/validate against a clean corpus before alerting"
    strings:
        $api1 = "OpenClipboard" ascii wide
        $api2 = "SetClipboardData" ascii wide
        $api3 = "GetClipboardData" ascii wide
        $api4 = "AddClipboardFormatListener" ascii wide
        $re_btc = "[a-km-zA-HJ-NP-Z1-9]{25,34}" ascii wide
        $re_eth = "0x[a-fA-F0-9]{40}" ascii wide
        $re_bech = "bc1[ac-hj-np-z02-9]" ascii wide
    condition:
        uint16(0) == 0x5A4D and filesize < 5MB and
        2 of ($api*) and 2 of ($re_*)
}

Prove It with a Canary

The most convincing test is behavioural. Place a syntactically valid address you control on the clipboard, wait, and read it back. If the value changes with no user action, something on that host is swapping addresses. Run it from your endpoint tooling against suspect hosts or as a periodic purple-team check:

# Clipboard canary - run in the interactive user session
$canary = '<ADDRESS_YOU_CONTROL>'          # a valid-format address you own; never a real balance
Set-Clipboard -Value $canary
Start-Sleep -Seconds 20
$now = Get-Clipboard -Raw
if ($now.Trim() -ne $canary) { "CLIPBOARD CHANGED: possible clipper on $env:COMPUTERNAME" }
# tune/validate: clipboard managers and remote-desktop tools can also rewrite content

Finance and crypto-handling staff are the highest-value targets. Require a second, out-of-band check of the first and last characters of any destination address before a transfer.
Treat a confirmed clipper as evidence of a wider stealer infection and run the full credential and wallet remediation.
Block execution from user-writable paths with application control; clippers are rarely signed.

Vetted sources

Use MITRE ATT&CK T1115, the YARA rules published in public malware-research repositories for specific clipper families, and EDR vendor documentation on clipboard API telemetry. Baseline your environment: clipboard managers, remote-desktop clients and password managers legitimately monitor the clipboard.

Build Detections That Fire

Mjolnir Security helps blue teams turn threat intelligence into high-fidelity detections across endpoint, network, identity and cloud telemetry.

Detection EngineeringManaged Detection & ResponseThreat HuntingIncident ResponsePurple Teaming

Detection Engineering We build and tune detections mapped to ATT&CK from your own telemetry.
Threat Hunting as a Service Hypothesis-driven hunts for the behaviours on this page.
24/7 Incident Response Containment when a detection fires. Call +1 833 403 5875.

Written by: Mjolnir Threat Research (MTAC)  |  Published: October 12, 2026  |  Last reviewed: October 12, 2026

Signals at a Glance

Static Hunting for Clipper Logic

Prove It with a Canary

Build Detections That Fire

Infostealer Detection

Detection Hub

Crypto Wallet Theft Detection

Loader-to-Stealer Chain Detection